Initial commit

apps/backend/src/middlewares/require-auth.middleware.ts

@@ -0,0 +1,50 @@
+import type { MiddlewareHandler } from 'hono'
+import { db } from '@/lib/prisma'
+import { supabase } from '@/lib/supabase'
+import type { AppEnv } from '@/types/hono'
+
+function getBearerToken(value: string | undefined): string | null {
+  if (!value) return null
+  const [scheme, token] = value.split(' ')
+  if (scheme?.toLowerCase() !== 'bearer' || !token) return null
+  return token
+}
+
+export const requireAuth: MiddlewareHandler<AppEnv> = async (
+  c,
+  next,
+) => {
+  const token = getBearerToken(c.req.header('authorization'))
+
+  if (!token) {
+    return c.json({ message: 'Missing bearer token.' }, 403)
+  }
+
+  const { data, error } = await supabase.auth.getUser(token)
+
+  if (error || !data.user) {
+    return c.json({ message: 'Invalid or expired token.' }, 403)
+  }
+
+  const email = data.user.email?.toLowerCase()
+
+  if (!email) {
+    return c.json({ message: 'Auth user does not contain email.' }, 403)
+  }
+
+  const appUser = await db.user.findFirst({
+    where: {
+      supabaseUserId: data.user.id,
+      email,
+    },
+    select: { id: true },
+  })
+
+  if (!appUser) {
+    return c.json({ message: 'User not provisioned in backend.' }, 403)
+  }
+
+  c.set('authUser', data.user)
+  c.set('appUserId', appUser.id)
+  await next()
+}