pear-git / lib / middleware / admin.js

/**
 * Admin Middleware
 *
 * Middleware for admin-only routes
 */

import { unauthorized, forbidden } from '../response.js'

/**
 * Require admin permission
 * Attaches auth result to req.auth
 * Returns 403 if not admin
 */
export async function requireAdmin(req, res, server) {
  if (!server.authEnabled) {
    // Auth disabled - allow admin access (dangerous but matches existing behavior)
    req.auth = null
    return true
  }

  const auth = await server.authManager.authenticate(req)

  if (!auth) {
    unauthorized(res, 'Authentication required')
    return false
  }

  if (!auth.permissions.admin) {
    console.log(`[Admin] Access denied for ${auth.method} (userId: ${auth.userId})`)
    forbidden(res, 'Admin access required')
    return false
  }

  req.auth = auth
  return true
}

/**
 * Require admin for destructive operations
 * Extra logging for audit trail
 */
export async function requireAdminWithAudit(req, res, server) {
  const result = await requireAdmin(req, res, server)

  if (result && req.auth) {
    console.log(`[Admin Audit] ${req.method} ${req.url} by userId: ${req.auth.userId}`)
  }

  return result
}