init

apps/api/src/auth/current-user.ts

@@ -0,0 +1,31 @@
+import type { AuthUser } from "@orderops/shared";
+import type { FastifyReply, FastifyRequest } from "fastify";
+import type { DatabaseContext } from "../db/database";
+import { findSessionUser } from "./auth-repository";
+import { readSessionCookie } from "./session-cookie";
+
+export async function getCurrentUser(context: DatabaseContext, cookieHeader?: string) {
+  const sessionId = readSessionCookie(cookieHeader);
+
+  if (!sessionId) {
+    return null;
+  }
+
+  return findSessionUser(context, sessionId);
+}
+
+export async function requireEmployeeUser(context: DatabaseContext, request: FastifyRequest, reply: FastifyReply): Promise<AuthUser | null> {
+  const user = await getCurrentUser(context, request.headers.cookie);
+
+  if (!user) {
+    await reply.code(401).send({ message: "Authentication required." });
+    return null;
+  }
+
+  if (user.role !== "employee") {
+    await reply.code(403).send({ message: "Employee access required." });
+    return null;
+  }
+
+  return user;
+}