88 lines
2.2 KiB
TypeScript
88 lines
2.2 KiB
TypeScript
import "server-only";
|
|
import { getServerSession } from "next-auth";
|
|
import type { Session } from "next-auth";
|
|
import { db } from "@/db";
|
|
import { authOptions } from "@/lib/auth-options";
|
|
import { getGuildMemberRoles } from "@/lib/discord";
|
|
|
|
export type SessionWithDiscord = Session & {
|
|
user?: Session["user"] & {
|
|
id?: string;
|
|
discordId?: string;
|
|
};
|
|
};
|
|
|
|
export type FormAccessConfig = {
|
|
id: string;
|
|
allowedRoles?: string[] | null;
|
|
deniedRoles?: string[] | null;
|
|
};
|
|
|
|
export function getAdminDiscordIds() {
|
|
return (process.env.ADMIN_DISCORD_IDS ?? "")
|
|
.split(",")
|
|
.map((id) => id.trim())
|
|
.filter(Boolean);
|
|
}
|
|
|
|
export function getSessionDiscordId(session: Session | null) {
|
|
return (session as SessionWithDiscord | null)?.user?.discordId ?? null;
|
|
}
|
|
|
|
export async function getCurrentDiscordId() {
|
|
const session = await getServerSession(authOptions);
|
|
return getSessionDiscordId(session);
|
|
}
|
|
|
|
export async function requireDiscordId() {
|
|
const discordId = await getCurrentDiscordId();
|
|
if (!discordId) {
|
|
throw new Error("Not authenticated");
|
|
}
|
|
return discordId;
|
|
}
|
|
|
|
export async function requireAdmin() {
|
|
const discordId = await requireDiscordId();
|
|
if (!getAdminDiscordIds().includes(discordId)) {
|
|
throw new Error("Unauthorized");
|
|
}
|
|
return discordId;
|
|
}
|
|
|
|
export async function canAccessForm(form: FormAccessConfig, discordId: string | null) {
|
|
const allowedRoles = form.allowedRoles ?? [];
|
|
const deniedRoles = form.deniedRoles ?? [];
|
|
|
|
if (allowedRoles.length === 0 && deniedRoles.length === 0) {
|
|
return true;
|
|
}
|
|
|
|
if (!discordId) {
|
|
return false;
|
|
}
|
|
|
|
const userRoles = await getGuildMemberRoles(discordId);
|
|
const isAllowed =
|
|
allowedRoles.length === 0 || userRoles.some((role) => allowedRoles.includes(role));
|
|
const isDenied = deniedRoles.some((role) => userRoles.includes(role));
|
|
|
|
return isAllowed && !isDenied;
|
|
}
|
|
|
|
export async function requireFormAccess(formId: string, discordId: string) {
|
|
const form = await db.query.forms.findFirst({
|
|
where: (forms, { eq }) => eq(forms.id, formId),
|
|
});
|
|
|
|
if (!form) {
|
|
throw new Error("Form not found");
|
|
}
|
|
|
|
if (!(await canAccessForm(form, discordId))) {
|
|
throw new Error("Unauthorized");
|
|
}
|
|
|
|
return form;
|
|
}
|