100 lines
2.4 KiB
TypeScript
100 lines
2.4 KiB
TypeScript
import "server-only";
|
|
|
|
import { betterAuth } from "better-auth";
|
|
import { drizzleAdapter } from "better-auth/adapters/drizzle";
|
|
import { nextCookies } from "better-auth/next-js";
|
|
import { headers } from "next/headers";
|
|
|
|
import { getDb } from "@/db";
|
|
import {
|
|
accounts,
|
|
sessions,
|
|
users,
|
|
verifications,
|
|
} from "@/db/schema";
|
|
|
|
import { isAuthorizedAdmin, type SessionUserLike } from "./authorization";
|
|
|
|
function required(name: string): string {
|
|
const value = process.env[name];
|
|
if (!value) throw new Error(`${name} is required for authentication.`);
|
|
return value;
|
|
}
|
|
|
|
function createAuth() {
|
|
return betterAuth({
|
|
appName: "Buzz Sheet",
|
|
database: drizzleAdapter(getDb(), {
|
|
provider: "pg",
|
|
schema: {
|
|
user: users,
|
|
session: sessions,
|
|
account: accounts,
|
|
verification: verifications,
|
|
},
|
|
transaction: true,
|
|
}),
|
|
baseURL: required("BETTER_AUTH_URL"),
|
|
secret: required("BETTER_AUTH_SECRET"),
|
|
socialProviders: {
|
|
google: {
|
|
clientId: required("GOOGLE_CLIENT_ID"),
|
|
clientSecret: required("GOOGLE_CLIENT_SECRET"),
|
|
},
|
|
},
|
|
plugins: [nextCookies()],
|
|
});
|
|
}
|
|
|
|
type AuthInstance = ReturnType<typeof createAuth>;
|
|
let authInstance: AuthInstance | undefined;
|
|
|
|
export function getAuth(): AuthInstance {
|
|
if (!authInstance) authInstance = createAuth();
|
|
return authInstance;
|
|
}
|
|
|
|
export interface AdminSession {
|
|
user: SessionUserLike;
|
|
session: { id: string };
|
|
}
|
|
|
|
export async function getAdminSession(): Promise<AdminSession | null> {
|
|
if (process.env.BUZZ_DEMO_MODE === "true") {
|
|
return {
|
|
user: {
|
|
id: "demo-admin",
|
|
email: "[email protected]",
|
|
emailVerified: true,
|
|
name: "Demo Admin",
|
|
},
|
|
session: { id: "demo-session" },
|
|
};
|
|
}
|
|
|
|
const session = await getAuth().api.getSession({ headers: await headers() });
|
|
if (
|
|
!session?.session ||
|
|
!isAuthorizedAdmin(session.user, process.env.ADMIN_EMAIL)
|
|
) {
|
|
return null;
|
|
}
|
|
return {
|
|
user: session.user,
|
|
session: { id: session.session.id },
|
|
};
|
|
}
|
|
|
|
export class AdminAuthorizationError extends Error {
|
|
constructor() {
|
|
super("Admin authorization required.");
|
|
this.name = "AdminAuthorizationError";
|
|
}
|
|
}
|
|
|
|
export async function requireAdmin(): Promise<AdminSession> {
|
|
const session = await getAdminSession();
|
|
if (!session) throw new AdminAuthorizationError();
|
|
return session;
|
|
}
|