Initial commit

apps/backend/src/middlewares/require-super-admin.middleware.ts

@@ -0,0 +1,35 @@
+import type { MiddlewareHandler } from 'hono'
+import type { AppEnv } from '@/types/hono'
+
+function getSuperAdminEmails(): Set<string> {
+  const raw = Bun.env.SUPER_ADMIN_EMAILS ?? ''
+  const emails = raw
+    .split(',')
+    .map((value) => value.trim().toLowerCase())
+    .filter(Boolean)
+  return new Set(emails)
+}
+
+export const requireSuperAdmin: MiddlewareHandler<AppEnv> = async (
+  c,
+  next,
+) => {
+  const authUser = c.get('authUser')
+  const role =
+    typeof authUser.app_metadata?.role === 'string'
+      ? authUser.app_metadata.role
+      : null
+  const email = authUser.email?.toLowerCase()
+
+  if (role === 'super_admin') {
+    await next()
+    return
+  }
+
+  if (email && getSuperAdminEmails().has(email)) {
+    await next()
+    return
+  }
+
+  return c.json({ message: 'Este recurso requiere permisos de super admin.' }, 403)
+}