Extract backend auth middleware

backend/index.js

@@ -12,6 +12,7 @@ const { hashSecret, maskSecret } = require('./utils/security');
 const transporter = require('./services/mailer');
 const { createCorsMiddleware } = require('./config/cors');
 const { allowedOrigins, getBaseUrl, getStartupBaseUrl, isProduction, jwtSecret: JWT_SECRET, port: PORT } = require('./config/runtime');
+const { authenticateToken, requireRole } = require('./middleware/auth');
 const {
   canReadUser,
   canUpdateUser,
@@ -71,60 +72,6 @@ app.use('/uploads', express.static(uploadDir, {
 // --- API Router ---
 const apiRouter = express.Router();
 
-// Middleware de autenticação
-const authenticateToken = async (req, res, next) => {
-  // Ignorar rotas de auth
-  if (req.path.startsWith('/auth/')) return next();
-
-  const authHeader = req.headers['authorization'];
-  
-  // API Key Authentication for n8n/External Integrations
-  if (authHeader && authHeader.startsWith('Bearer fasto_sk_')) {
-    const apiKey = authHeader.split(' ')[1];
-    try {
-      const [keys] = await pool.query(
-        'SELECT * FROM api_keys WHERE secret_hash = ? OR secret_key = ?',
-        [hashSecret(apiKey), apiKey]
-      );
-      if (keys.length === 0) return res.status(401).json({ error: 'Chave de API inválida.' });
-      
-      // Update last used timestamp
-      await pool.query('UPDATE api_keys SET last_used_at = CURRENT_TIMESTAMP WHERE id = ?', [keys[0].id]);
-      
-      // Attach a "system/bot" user identity to the request based on the tenant
-      req.user = {
-        id: 'bot_integration',
-        tenant_id: keys[0].tenant_id,
-        role: 'admin', // Give integration admin privileges within its tenant
-        is_api_key: true
-      };
-      return next();
-    } catch (error) {
-      console.error('API Key validation error:', error);
-      return res.status(500).json({ error: 'Erro ao validar chave de API.' });
-    }
-  }
-
-  // Standard JWT Authentication
-  const token = authHeader && authHeader.split(' ')[1];
-
-  if (!token) return res.status(401).json({ error: 'Token não fornecido.' });
-
-  try {
-    const user = jwt.verify(token, JWT_SECRET);
-    req.user = user;
-    next();
-  } catch (err) {
-    return res.status(401).json({ error: 'Token inválido ou expirado.' });
-  }
-};
-
-const requireRole = (roles) => (req, res, next) => {
-  if (!req.user || !req.user.role) return res.status(401).json({ error: 'Não autenticado.' });
-  if (!roles.includes(req.user.role)) return res.status(403).json({ error: 'Acesso negado. Você não tem permissão para realizar esta ação.' });
-  next();
-};
-
 apiRouter.use(authenticateToken);
 
 // --- Auth Routes ---