jtricerolph
4754231f6f
Adds three new granular capabilities: - history: gates /history page and GET /api/cashup/history - cash_summary: gates /summary page and GET /api/reports/cash-summary - safe_count: gates /safe page and safe_cash float routes Updates legacy-token fallback to include all seven non-settings caps. Route guards and nav items updated to use the split caps. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
65 lines
2.2 KiB
JavaScript
65 lines
2.2 KiB
JavaScript
import { jwtVerify } from 'jose'
|
|
import { isOnsite } from './ip-check.js'
|
|
|
|
const APP_SLUG = process.env.APP_SLUG || 'cashup'
|
|
const secret = new TextEncoder().encode(process.env.CENTRAL_AUTH_SECRET || '')
|
|
|
|
export async function requireAuth(request, reply) {
|
|
const token = request.cookies?.hnf_session
|
|
if (!token) return reply.status(401).send({ error: 'Not authenticated' })
|
|
|
|
let payload
|
|
try {
|
|
const { payload: p } = await jwtVerify(token, secret)
|
|
payload = p
|
|
} catch {
|
|
return reply.status(401).send({ error: 'Invalid session' })
|
|
}
|
|
|
|
if (!payload.apps?.includes(APP_SLUG)) {
|
|
return reply.status(403).send({ error: 'No permission for this app' })
|
|
}
|
|
|
|
if (!payload.offsite_allowed) {
|
|
const clientIP = request.headers['x-real-ip'] || request.ip
|
|
if (!(await isOnsite(clientIP))) {
|
|
return reply.status(403).send({ error: 'Access restricted to site network' })
|
|
}
|
|
}
|
|
|
|
// Capabilities arrive as "<app>:<cap>" strings in the JWT. Store the bare
|
|
// cap slugs for this app (e.g. "finalise") plus admin status.
|
|
const prefix = `${APP_SLUG}:`
|
|
let caps
|
|
if (Array.isArray(payload.caps)) {
|
|
caps = payload.caps.filter(c => c.startsWith(prefix)).map(c => c.slice(prefix.length))
|
|
} else {
|
|
// Legacy token issued before granular capabilities existed. Reproduce the
|
|
// old behaviour: full access except settings (which was is_admin-gated).
|
|
// These users get precise capabilities the next time they log in.
|
|
caps = ['count', 'finalise', 'history', 'reports', 'cash_summary', 'floats', 'safe_count']
|
|
}
|
|
|
|
request.user = {
|
|
email: payload.sub,
|
|
name: payload.name,
|
|
is_admin: payload.is_admin ?? false,
|
|
caps,
|
|
}
|
|
}
|
|
|
|
// Returns true if the authenticated user holds the given capability.
|
|
// Admins implicitly hold every capability.
|
|
export function hasCap(request, cap) {
|
|
return request.user?.is_admin === true || request.user?.caps?.includes(cap) === true
|
|
}
|
|
|
|
// Fastify preHandler factory — reject the request unless the user holds `cap`.
|
|
// Use after requireAuth: { preHandler: [requireAuth, requireCap('finalise')] }
|
|
export function requireCap(cap) {
|
|
return async (request, reply) => {
|
|
if (!hasCap(request, cap)) {
|
|
return reply.status(403).send({ error: `Missing capability: ${cap}` })
|
|
}
|
|
}
|
|
}
|