99 lines
3.2 KiB
TypeScript
99 lines
3.2 KiB
TypeScript
import { redirect } from 'next/navigation';
|
|
import { NextResponse } from 'next/server';
|
|
import { ZodError } from 'zod';
|
|
import { hasManageGuildPermission } from '@nexumi/shared';
|
|
import { fetchDiscordUserGuildsCached } from './discord-oauth';
|
|
import { prisma } from './prisma';
|
|
import { getSession, type SessionPayload } from './session';
|
|
|
|
export class UnauthorizedError extends Error {
|
|
constructor(message = 'Authentication required') {
|
|
super(message);
|
|
this.name = 'UnauthorizedError';
|
|
}
|
|
}
|
|
|
|
export class ForbiddenError extends Error {
|
|
constructor(message = 'You do not have access to this resource') {
|
|
super(message);
|
|
this.name = 'ForbiddenError';
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Use in API routes. Throws {@link UnauthorizedError} when no session exists.
|
|
*/
|
|
export async function requireAuth(): Promise<SessionPayload> {
|
|
const session = await getSession();
|
|
if (!session) {
|
|
throw new UnauthorizedError();
|
|
}
|
|
return session;
|
|
}
|
|
|
|
/**
|
|
* Use in Server Components / layouts. Redirects to /login instead of throwing,
|
|
* since there is no JSON response to return.
|
|
*/
|
|
export async function requireAuthOrRedirect(): Promise<SessionPayload> {
|
|
const session = await getSession();
|
|
if (!session) {
|
|
redirect('/login');
|
|
}
|
|
return session;
|
|
}
|
|
|
|
/**
|
|
* Ensures the current session user has Manage Guild permission on the given
|
|
* guild (via Discord OAuth guild list) and that the bot is actually installed
|
|
* there (tracked via the `Guild` table). Use in API routes.
|
|
*/
|
|
export async function requireGuildAccess(guildId: string): Promise<SessionPayload> {
|
|
const session = await requireAuth();
|
|
const guilds = await fetchDiscordUserGuildsCached(session.accessToken);
|
|
const guild = guilds.find((entry) => entry.id === guildId);
|
|
if (!guild || !hasManageGuildPermission(guild.permissions)) {
|
|
throw new ForbiddenError('Missing Manage Guild permission for this server');
|
|
}
|
|
const dbGuild = await prisma.guild.findUnique({ where: { id: guildId } });
|
|
if (!dbGuild) {
|
|
throw new ForbiddenError('Nexumi is not installed on this server');
|
|
}
|
|
return session;
|
|
}
|
|
|
|
/**
|
|
* Same as {@link requireGuildAccess} but for Server Components: redirects
|
|
* instead of throwing.
|
|
*/
|
|
export async function requireGuildAccessOrRedirect(guildId: string): Promise<SessionPayload> {
|
|
const session = await requireAuthOrRedirect();
|
|
const guilds = await fetchDiscordUserGuildsCached(session.accessToken);
|
|
const guild = guilds.find((entry) => entry.id === guildId);
|
|
if (!guild || !hasManageGuildPermission(guild.permissions)) {
|
|
redirect('/dashboard');
|
|
}
|
|
const dbGuild = await prisma.guild.findUnique({ where: { id: guildId } });
|
|
if (!dbGuild) {
|
|
redirect('/dashboard');
|
|
}
|
|
return session;
|
|
}
|
|
|
|
export function toApiErrorResponse(error: unknown): NextResponse {
|
|
if (error instanceof UnauthorizedError) {
|
|
return NextResponse.json({ error: error.message }, { status: 401 });
|
|
}
|
|
if (error instanceof ForbiddenError) {
|
|
return NextResponse.json({ error: error.message }, { status: 403 });
|
|
}
|
|
if (error instanceof ZodError) {
|
|
return NextResponse.json(
|
|
{ error: 'Validation failed', issues: error.issues },
|
|
{ status: 400 }
|
|
);
|
|
}
|
|
console.error('[api]', error);
|
|
return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
|
|
}
|