Initial commit

apps/backend/src/middlewares/require-auth.middleware.ts

@@ -0,0 +1,50 @@
+import type { MiddlewareHandler } from 'hono'
+import { db } from '@/lib/prisma'
+import { supabase } from '@/lib/supabase'
+import type { AppEnv } from '@/types/hono'
+
+function getBearerToken(value: string | undefined): string | null {
+  if (!value) return null
+  const [scheme, token] = value.split(' ')
+  if (scheme?.toLowerCase() !== 'bearer' || !token) return null
+  return token
+}
+
+export const requireAuth: MiddlewareHandler<AppEnv> = async (
+  c,
+  next,
+) => {
+  const token = getBearerToken(c.req.header('authorization'))
+
+  if (!token) {
+    return c.json({ message: 'Missing bearer token.' }, 403)
+  }
+
+  const { data, error } = await supabase.auth.getUser(token)
+
+  if (error || !data.user) {
+    return c.json({ message: 'Invalid or expired token.' }, 403)
+  }
+
+  const email = data.user.email?.toLowerCase()
+
+  if (!email) {
+    return c.json({ message: 'Auth user does not contain email.' }, 403)
+  }
+
+  const appUser = await db.user.findFirst({
+    where: {
+      supabaseUserId: data.user.id,
+      email,
+    },
+    select: { id: true },
+  })
+
+  if (!appUser) {
+    return c.json({ message: 'User not provisioned in backend.' }, 403)
+  }
+
+  c.set('authUser', data.user)
+  c.set('appUserId', appUser.id)
+  await next()
+}

apps/backend/src/middlewares/require-super-admin.middleware.ts

@@ -0,0 +1,35 @@
+import type { MiddlewareHandler } from 'hono'
+import type { AppEnv } from '@/types/hono'
+
+function getSuperAdminEmails(): Set<string> {
+  const raw = Bun.env.SUPER_ADMIN_EMAILS ?? ''
+  const emails = raw
+    .split(',')
+    .map((value) => value.trim().toLowerCase())
+    .filter(Boolean)
+  return new Set(emails)
+}
+
+export const requireSuperAdmin: MiddlewareHandler<AppEnv> = async (
+  c,
+  next,
+) => {
+  const authUser = c.get('authUser')
+  const role =
+    typeof authUser.app_metadata?.role === 'string'
+      ? authUser.app_metadata.role
+      : null
+  const email = authUser.email?.toLowerCase()
+
+  if (role === 'super_admin') {
+    await next()
+    return
+  }
+
+  if (email && getSuperAdminEmails().has(email)) {
+    await next()
+    return
+  }
+
+  return c.json({ message: 'Este recurso requiere permisos de super admin.' }, 403)
+}