refactor(lib): organize modules by feature

lib/auth/auth-options.ts

@@ -0,0 +1,62 @@
+import "server-only";
+import type { NextAuthOptions } from "next-auth";
+import DiscordProvider from "next-auth/providers/discord";
+import { DrizzleAdapter } from "@auth/drizzle-adapter";
+import { db } from "@/db";
+import { accounts, sessions, users, verificationTokens } from "@/db/schema";
+import type { SessionWithDiscord } from "@/lib/auth/auth";
+import { addDiscordGuildMember } from "@/lib/discord/discord";
+
+const discordIdCache = new Map<string, string>();
+
+export const authOptions: NextAuthOptions = {
+  adapter: DrizzleAdapter(db, {
+    usersTable: users,
+    accountsTable: accounts,
+    sessionsTable: sessions,
+    verificationTokensTable: verificationTokens,
+  }),
+  providers: [
+    DiscordProvider({
+      clientId: process.env.DISCORD_CLIENT_ID!,
+      clientSecret: process.env.DISCORD_CLIENT_SECRET!,
+      authorization: {
+        params: {
+          scope: "identify email guilds.join",
+        },
+      },
+    }),
+  ],
+  callbacks: {
+    async signIn({ account }) {
+      if (account?.provider === "discord" && account.providerAccountId && account.access_token) {
+        await addDiscordGuildMember(account.providerAccountId, account.access_token);
+      }
+
+      return true;
+    },
+    async session({ session, user }) {
+      if (session.user) {
+        (session as SessionWithDiscord).user!.id = user.id;
+
+        let discordId = discordIdCache.get(user.id);
+        if (!discordId) {
+          const account = await db.query.accounts.findFirst({
+            where: (record, { eq, and }) =>
+              and(eq(record.userId, user.id), eq(record.provider, "discord")),
+            columns: { providerAccountId: true },
+          });
+          if (account) {
+            discordId = account.providerAccountId;
+            discordIdCache.set(user.id, discordId);
+          }
+        }
+        if (discordId) {
+          (session as SessionWithDiscord).user!.discordId = discordId;
+        }
+      }
+      return session;
+    },
+  },
+  secret: process.env.NEXTAUTH_SECRET,
+};

lib/auth/auth.ts

@@ -0,0 +1,87 @@
+import "server-only";
+import { getServerSession } from "next-auth";
+import type { Session } from "next-auth";
+import { db } from "@/db";
+import { authOptions } from "@/lib/auth/auth-options";
+import { getGuildMemberRoles } from "@/lib/discord/discord";
+
+export type SessionWithDiscord = Session & {
+  user?: Session["user"] & {
+    id?: string;
+    discordId?: string;
+  };
+};
+
+export type FormAccessConfig = {
+  id: string;
+  allowedRoles?: string[] | null;
+  deniedRoles?: string[] | null;
+};
+
+export function getAdminDiscordIds() {
+  return (process.env.ADMIN_DISCORD_IDS ?? "")
+    .split(",")
+    .map((id) => id.trim())
+    .filter(Boolean);
+}
+
+export function getSessionDiscordId(session: Session | null) {
+  return (session as SessionWithDiscord | null)?.user?.discordId ?? null;
+}
+
+export async function getCurrentDiscordId() {
+  const session = await getServerSession(authOptions);
+  return getSessionDiscordId(session);
+}
+
+export async function requireDiscordId() {
+  const discordId = await getCurrentDiscordId();
+  if (!discordId) {
+    throw new Error("Not authenticated");
+  }
+  return discordId;
+}
+
+export async function requireAdmin() {
+  const discordId = await requireDiscordId();
+  if (!getAdminDiscordIds().includes(discordId)) {
+    throw new Error("Unauthorized");
+  }
+  return discordId;
+}
+
+export async function canAccessForm(form: FormAccessConfig, discordId: string | null) {
+  const allowedRoles = form.allowedRoles ?? [];
+  const deniedRoles = form.deniedRoles ?? [];
+
+  if (allowedRoles.length === 0 && deniedRoles.length === 0) {
+    return true;
+  }
+
+  if (!discordId) {
+    return false;
+  }
+
+  const userRoles = await getGuildMemberRoles(discordId);
+  const isAllowed =
+    allowedRoles.length === 0 || userRoles.some((role) => allowedRoles.includes(role));
+  const isDenied = deniedRoles.some((role) => userRoles.includes(role));
+
+  return isAllowed && !isDenied;
+}
+
+export async function requireFormAccess(formId: string, discordId: string) {
+  const form = await db.query.forms.findFirst({
+    where: (forms, { eq }) => eq(forms.id, formId),
+  });
+
+  if (!form) {
+    throw new Error("Form not found");
+  }
+
+  if (!(await canAccessForm(form, discordId))) {
+    throw new Error("Unauthorized");
+  }
+
+  return form;
+}