studiocms/dist/frontend/pages/studiocms_api/dashboard/verify-session.js

Astro Native CMS for AstroDB. Built from the ground up by the Astro community.

import { Session } from "studiocms:auth/lib";
import { logger as _logger } from "studiocms:logger";
import { SDKCore } from "studiocms:sdk";
import { AuthSessionCookieName } from "../../../../consts.js";
import {
  AllResponse,
  createEffectAPIRoutes,
  createJsonResponse,
  Effect,
  genLogger,
  OptionsResponse,
  parseAPIContextJson,
  Schema
} from "../../../../effect.js";
class JsonData extends Schema.Class("JsonData")({
  originPathname: Schema.String
}) {
}
const responseBuilder = (context, isLoggedIn, user, permissionLevel) => {
  const data = {
    isLoggedIn,
    user: user ? {
      id: user.id,
      name: user.name,
      email: user.email,
      avatar: user.avatar,
      username: user.username
    } : null,
    permissionLevel,
    routes: {
      logout: context.locals.StudioCMS.routeMap.authLinks.logoutAPI,
      userProfile: context.locals.StudioCMS.routeMap.mainLinks.userProfile,
      contentManagement: context.locals.StudioCMS.routeMap.mainLinks.contentManagement,
      dashboardIndex: context.locals.StudioCMS.routeMap.mainLinks.dashboardIndex
    }
  };
  return createJsonResponse(data);
};
const { POST, OPTIONS, ALL } = createEffectAPIRoutes(
  {
    POST: (ctx) => genLogger("studiocms/routes/api/dashboard/verify-session.POST")(function* () {
      const [ses, sdk] = yield* Effect.all([Session, SDKCore]);
      const logger = _logger.fork("studiocms:runtime:api:verify-session");
      const { cookies } = ctx;
      const { originPathname } = yield* parseAPIContextJson(ctx, JsonData);
      const sessionToken = cookies.get(AuthSessionCookieName)?.value ?? null;
      if (!sessionToken) {
        logger.info(
          `No session token found in cookies, returning unknown session status. Origin: ${originPathname}`
        );
        return responseBuilder(ctx, false, null, "unknown");
      }
      const { session, user } = yield* ses.validateSessionToken(sessionToken);
      if (session === null) {
        yield* ses.deleteSessionTokenCookie(ctx);
        logger.info(
          `Session token is invalid or expired, deleting cookie. Origin: ${originPathname}`
        );
        return responseBuilder(ctx, false, null, "unknown");
      }
      if (!user || user === null) {
        logger.info(
          `No user found for session token, returning unknown session status. Origin: ${originPathname}`
        );
        return responseBuilder(ctx, false, null, "unknown");
      }
      const result = yield* sdk.AUTH.permission.currentStatus(user.id);
      if (!result) {
        logger.error(
          `Failed to retrieve permission status for user ${user.id}, returning unknown session status. Origin: ${originPathname}`
        );
        return responseBuilder(ctx, true, user, "unknown");
      }
      let permissionLevel = "unknown";
      switch (result.rank) {
        case "owner":
          permissionLevel = "owner";
          break;
        case "admin":
          permissionLevel = "admin";
          break;
        case "editor":
          permissionLevel = "editor";
          break;
        case "visitor":
          permissionLevel = "visitor";
          break;
        default:
          permissionLevel = "unknown";
          break;
      }
      return responseBuilder(ctx, true, user, permissionLevel);
    }),
    OPTIONS: () => Effect.try(() => OptionsResponse({ allowedMethods: ["POST"] })),
    ALL: () => Effect.try(() => AllResponse())
  },
  {
    cors: { methods: ["POST", "OPTIONS"] },
    onError: (error) => {
      console.error("API Error:", error);
      return createJsonResponse(
        { error: "Internal Server Error" },
        {
          status: 500
        }
      );
    }
  }
);
export {
  ALL,
  JsonData,
  OPTIONS,
  POST
};