@lucidcms/core
Version:
The core of the Lucid CMS. It's responsible for spinning up the API and serving the CMS.
2 lines • 2.88 kB
JavaScript
import{copy as e}from"../../i18n/copy.mjs";import t from"../../../constants/constants.mjs";import n from"../../../utils/errors/lucid-api-error.mjs";import r from"../../repositories/users.mjs";import{multiTenancyEnabled as i}from"../../../utils/helpers/tenants.mjs";import a from"../../kv/cache-keys.mjs";import{getAuthCacheNamespaceToken as o}from"../../../services/auth/helpers/auth-cache.mjs";import s from"../../../services/auth/access-token/verify-token.mjs";import c from"../utils/create-service-context.mjs";import l from"../../formatters/user-permissions.mjs";import u from"../../formatters/index.mjs";import{createMiddleware as d}from"hono/factory";const f=async(e,t,n)=>{let r=c(e),i=await o(r),s=a.auth.user(t.id,i,n);return{cacheKey:s,context:r,data:await r.kv.get(r,{key:s,hash:!0})}},p=async(t,i,a)=>{let o=t.get(`config`),s=await new r(t.get(`database`).client,o.db).selectAccessTokenUser({where:[{key:`id`,operator:`=`,value:i.id},{key:`is_deleted`,operator:`=`,value:o.db.getDefault(`boolean`,`false`)},{key:`is_locked`,operator:`=`,value:o.db.getDefault(`boolean`,`false`)}],tenantKey:a,validation:{enabled:!0,defaultError:{type:`authorisation`,code:`authorisation`,message:e(`server:core.permissions.unauthorized`),status:401}}});if(s.error)throw new n(s.error);let c=u.formatBoolean(s.data.super_admin??!1),{permissions:d}=l.formatMultiple({roles:s.data.roles||[],defaultLocale:o.localization.defaultLocale});return{id:s.data.id,username:s.data.username,email:s.data.email,permissions:d,superAdmin:c,tenantKeys:c?o.tenants.map(e=>e.key):(s.data.tenants??[]).map(e=>e.tenant_key)}},m=async(e,n,r)=>{let i=await f(e,n,r),a=i.data??await p(e,n,r);return i.data??await i.context.kv.set(i.context,{key:i.cacheKey,value:a,expirationTtl:t.authCacheExpiration,hash:!0}),{...a,exp:n.exp,iat:n.iat,nonce:n.nonce}},h=async(e,t)=>{let r=await s(e);if(r.error){if(t?.soft!==!0)throw new n(r.error);return}if(r.data)try{e.set(`auth`,await m(e,r.data,t?.tenantKey))}catch(e){if(t?.soft===!0)return;throw e}},g=e=>{let n=e.get(`config`);if(!i(n))return null;let r=e.req.header(t.headers.tenant);return r&&n.tenants.some(e=>e.key===r)?r:null},_=(r,a)=>{let o=r.get(`config`);if(!i(o)){r.set(`tenant`,null);return}let s=r.req.header(t.headers.tenant),c=r.get(`auth`);if(!s){if(a?.tenantScope===`allow-global`||c.superAdmin){r.set(`tenant`,null);return}throw new n({type:`authorisation`,message:e(`server:core.tenants.no.access`),status:403})}if(!o.tenants.some(e=>e.key===s))throw new n({type:`basic`,message:e(`server:core.tenants.unknown`,{data:{key:s}}),status:400});if(!c.superAdmin&&!c.tenantKeys.includes(s))throw new n({type:`authorisation`,message:e(`server:core.tenants.no.access`),status:403});r.set(`tenant`,{key:s})},v=e=>d(async(t,n)=>(await h(t,{tenantKey:g(t)}),_(t,e),await n()));export{h as authenticationCheck,v as default};
//# sourceMappingURL=authenticate.mjs.map