konnosauth-core-guard.ts48 lines · main
| 1 | /** |
| 2 | * Guards for briven-engine dashboard/admin APIs. |
| 3 | * |
| 4 | * - requireAuthCoreDashboard: must be signed in to briven.tech (platform session) |
| 5 | * - requireAuthCoreProject: must have access to :projectId (session or project API key) |
| 6 | * |
| 7 | * Customer login FDI (/v1/auth-core/fdi/*) stays public — those are app end-users. |
| 8 | * DEPLOY GATE: still local-only until complete product ships. |
| 9 | */ |
| 10 | |
| 11 | import type { MiddlewareHandler } from 'hono'; |
| 12 | |
| 13 | import { requireAuth } from './session.js'; |
| 14 | import { requireProjectAuth, requireProjectRole } from './project-auth.js'; |
| 15 | import { BRIVEN_ENGINE_ID } from '../services/auth-core/engine.js'; |
| 16 | |
| 17 | /** Platform operator / dashboard session required. */ |
| 18 | export const requireAuthCoreDashboard = (): MiddlewareHandler => { |
| 19 | const inner = requireAuth(); |
| 20 | return async (c, next) => { |
| 21 | // Brand unauthorized responses as briven-engine product surface |
| 22 | const user = c.get('user'); |
| 23 | if (!user && !c.get('apiKeyId')) { |
| 24 | const authHeader = c.req.header('authorization'); |
| 25 | if (!authHeader) { |
| 26 | return c.json( |
| 27 | { |
| 28 | code: 'unauthorized', |
| 29 | message: 'authentication required', |
| 30 | engine: BRIVEN_ENGINE_ID, |
| 31 | }, |
| 32 | 401, |
| 33 | ); |
| 34 | } |
| 35 | } |
| 36 | return inner(c, next); |
| 37 | }; |
| 38 | }; |
| 39 | |
| 40 | /** |
| 41 | * Project-scoped write/config for briven-engine. |
| 42 | * Path param must be named `projectId`. |
| 43 | */ |
| 44 | export const requireAuthCoreProject = ( |
| 45 | minRole: 'viewer' | 'developer' | 'admin' = 'admin', |
| 46 | ): MiddlewareHandler[] => { |
| 47 | return [requireProjectAuth('projectId'), requireProjectRole(minRole)]; |
| 48 | }; |