83 lines
2.2 KiB
JavaScript
83 lines
2.2 KiB
JavaScript
const jwt = require('jsonwebtoken');
|
|
const { ADMIN_EMAIL, ADMIN_PASSWORD, API_KEY, JWT_SECRET } = require('./config');
|
|
const { findUserByEmail, normalizeEmail, publicUserFields, verifyPassword } = require('./services/userService');
|
|
|
|
const verifyToken = (req, res, next) => {
|
|
const authHeader = req.headers.authorization;
|
|
if (!authHeader) return res.status(403).json({ error: 'No token provided' });
|
|
|
|
const token = authHeader.split(' ')[1];
|
|
if (!token) return res.status(403).json({ error: 'Malformed token' });
|
|
|
|
jwt.verify(token, JWT_SECRET, (err, decoded) => {
|
|
if (err) return res.status(401).json({ error: 'Unauthorized' });
|
|
req.user = decoded;
|
|
next();
|
|
});
|
|
};
|
|
|
|
const verifySuperAdmin = (req, res, next) => {
|
|
verifyToken(req, res, () => {
|
|
if (req.user?.role !== 'super_admin') {
|
|
res.status(403).json({ error: 'Super admin access required' });
|
|
return;
|
|
}
|
|
|
|
next();
|
|
});
|
|
};
|
|
|
|
const authenticateAPIKey = (req, res, next) => {
|
|
const apiKey = req.headers['x-api-key'];
|
|
if (apiKey === API_KEY) {
|
|
next();
|
|
return;
|
|
}
|
|
|
|
res.status(401).json({ error: 'Unauthorized: Invalid API Key' });
|
|
};
|
|
|
|
const buildTokenResponse = (user) => {
|
|
const token = jwt.sign(
|
|
{
|
|
email: user.email,
|
|
role: user.role,
|
|
userId: user.id || null
|
|
},
|
|
JWT_SECRET,
|
|
{ expiresIn: '24h' }
|
|
);
|
|
|
|
return { token, user };
|
|
};
|
|
|
|
const login = async (email, password) => {
|
|
const normalizedEmail = normalizeEmail(email);
|
|
|
|
if (normalizedEmail === normalizeEmail(ADMIN_EMAIL) && password === ADMIN_PASSWORD) {
|
|
return buildTokenResponse({
|
|
id: null,
|
|
name: 'Super Admin',
|
|
email: normalizedEmail,
|
|
role: 'super_admin'
|
|
});
|
|
}
|
|
|
|
const dbUser = await findUserByEmail(normalizedEmail);
|
|
if (!dbUser || !dbUser.is_active || !verifyPassword(password, dbUser.password_hash)) {
|
|
return null;
|
|
}
|
|
|
|
return buildTokenResponse({
|
|
...publicUserFields(dbUser),
|
|
role: 'user'
|
|
});
|
|
};
|
|
|
|
module.exports = {
|
|
verifyToken,
|
|
verifySuperAdmin,
|
|
authenticateAPIKey,
|
|
login
|
|
};
|