Adeyemi AdetunjiandRotimi Best
bc9e3b41ae
* feat: move community supabase request to api layer * chore: pr review checkpoint * chore: PR fixes * feat: implement role-based authorization middleware and align the community features with the developer guide. - Added role-based authorization middleware for organization and course membership checks, including `orgMemberMiddleware`, `orgTeamMemberMiddleware`, and `courseMemberMiddleware`. - Introduced route-specific middleware for comment and question authorization, ensuring only authors or team members can modify content. - Updated community routes to utilize the new middleware for enhanced security and access control. - Refactored community services to streamline upvote functionality and improve error handling. - Enhanced UI components for community interactions, including new comment and question pages, and improved state management for user actions. - Updated documentation to reflect new middleware usage and best practices for authorization in the API layer. * feat: enhance course and organization routes with middleware for improved access control - Added `courseMemberMiddleware` to course download and clone routes to enforce membership checks. - Updated lesson route to include `courseMemberMiddleware` for PDF downloads. - Integrated `orgMemberMiddleware` into organization routes for team and audience access, ensuring only authorized members can retrieve data. - Refactored lesson and organization routes for consistency and clarity in middleware usage. * chore: streamline dashboard and API development scripts in package.json - Consolidated dashboard and API development commands to include all relevant filters in a single line for improved clarity and ease of use. - Removed redundant full command variants to simplify the script section. --------- Co-authored-by: Rotimi Best <best@classroomio.com>
63 lines
1.3 KiB
TypeScript
63 lines
1.3 KiB
TypeScript
import { Context, Next } from 'hono';
|
|
|
|
import { ErrorCodes } from '@api/utils/errors';
|
|
import { isUserOrgMember } from '@cio/db/queries/organization';
|
|
|
|
/**
|
|
* Middleware to check if the authenticated user is a member of the organization
|
|
* Requires authMiddleware to be applied first
|
|
* Expects orgId in the 'cio-org-id' header
|
|
*/
|
|
export const orgMemberMiddleware = async (c: Context, next: Next) => {
|
|
try {
|
|
const user = c.get('user');
|
|
if (!user) {
|
|
return c.json(
|
|
{
|
|
success: false,
|
|
error: 'Unauthorized',
|
|
code: 'UNAUTHORIZED'
|
|
},
|
|
401
|
|
);
|
|
}
|
|
|
|
const orgId = c.req.header('cio-org-id');
|
|
|
|
if (!orgId) {
|
|
return c.json(
|
|
{
|
|
success: false,
|
|
error: 'Organization ID is required',
|
|
code: 'ORG_ID_REQUIRED'
|
|
},
|
|
400
|
|
);
|
|
}
|
|
|
|
const isMember = await isUserOrgMember(orgId, user.id);
|
|
if (!isMember) {
|
|
return c.json(
|
|
{
|
|
success: false,
|
|
error: 'UNAUTHORIZED',
|
|
code: 'UNAUTHORIZED'
|
|
},
|
|
403
|
|
);
|
|
}
|
|
|
|
await next();
|
|
} catch (error) {
|
|
console.error('Error in orgMemberMiddleware:', error);
|
|
return c.json(
|
|
{
|
|
success: false,
|
|
error: 'INTERNAL_ERROR',
|
|
code: 'INTERNAL_ERROR'
|
|
},
|
|
500
|
|
);
|
|
}
|
|
};
|