wcz-layout/dist/authMiddleware-C0MbAuvL.mjs

import { i as buildUser, o as hasPermission, u as getSessionUser } from "./utils-Bt_Hs0N8.mjs";
import { t as serverEnv } from "./env-CoveIivr.mjs";
import { createMiddleware } from "@tanstack/react-start";
import * as jose from "jose";
//#region src/middleware/authMiddleware.ts
async function resolveUser(request) {
	const authHeader = request.headers.get("Authorization");
	if (authHeader?.startsWith("Bearer ")) {
		let payload;
		try {
			payload = await verifyToken(authHeader.substring(7));
		} catch (error) {
			throw Response.json({ message: error instanceof Error ? error.message : "Unauthorized: Invalid access token" }, { status: 401 });
		}
		return buildUser(payload);
	}
	return getSessionUser();
}
const requiredAuthenticationMiddleware = createMiddleware().server(async ({ next, request }) => {
	const user = await resolveUser(request);
	if (!user) throw Response.json({ message: "Unauthorized: User not signed in" }, { status: 401 });
	return next({ context: { user } });
});
const publicAuthenticationMiddleware = createMiddleware().server(async ({ next, request }) => {
	return next({ context: { user: await resolveUser(request) } });
});
function authenticationMiddleware(options) {
	return options?.optional ? publicAuthenticationMiddleware : requiredAuthenticationMiddleware;
}
const authorizationMiddleware = (permissionKey) => createMiddleware().middleware([authenticationMiddleware()]).server(async ({ next, context }) => {
	if (hasPermission(context.user, permissionKey)) return next();
	throw Response.json({ message: `Forbidden: User ${context.user.name} is not authorized to access this resource` }, { status: 403 });
});
async function verifyToken(token) {
	const { payload } = await jose.jwtVerify(token, getJWKS(), {
		issuer: `https://login.microsoftonline.com/${serverEnv.ENTRA_TENANT_ID}/v2.0`,
		audience: serverEnv.ENTRA_CLIENT_ID
	});
	return payload;
}
let jwksCache = null;
function getJWKS() {
	jwksCache ??= jose.createRemoteJWKSet(new URL(`https://login.microsoftonline.com/${serverEnv.ENTRA_TENANT_ID}/discovery/v2.0/keys`));
	return jwksCache;
}
//#endregion
export { authorizationMiddleware as n, authenticationMiddleware as t };

//# sourceMappingURL=authMiddleware-C0MbAuvL.mjs.map