`middleware/auth.js`

33 lines
const auth = require('../lib/auth');

// Hydrate req.session + req.userId from the cookie
async function loadSessionMiddleware(req, _res, next) {
  const sid = req.cookies?.[auth.SESSION_COOKIE] || req.signedCookies?.[auth.SESSION_COOKIE];
  if (!sid) return next();
  const session = await auth.loadSession(sid);
  if (!session) return next();
  req.session = session;
  req.userId = session.user_id;
  next();
}

// Reject unauthenticated requests; redirect HTML to /signin, JSON gets 401
function requireAuth(req, res, next) {
  if (req.userId) return next();
  if (req.accepts('html')) return res.redirect('/signin?next=' + encodeURIComponent(req.originalUrl));
  return res.status(401).json({ error: 'unauthenticated' });
}

// Require recent (within 60s) successful TOTP verify
function requireStepUp(req, res, next) {
  if (!req.userId) {
    if (req.accepts('html')) return res.redirect('/signin?next=' + encodeURIComponent(req.originalUrl));
    return res.status(401).json({ error: 'unauthenticated' });
  }
  if (auth.isStepUpValid(req.session)) return next();
  if (req.accepts('html')) return res.redirect('/step-up?next=' + encodeURIComponent(req.originalUrl));
  return res.status(403).json({ error: 'step_up_required' });
}

module.exports = { loadSessionMiddleware, requireAuth, requireStepUp };