x

apps/backend/src/middleware/auth.ts

@@ -0,0 +1,30 @@
+import { Elysia } from "elysia";
+import { jwt } from "@elysiajs/jwt";
+
+export const adminOnly = new Elysia({ name: "adminOnly" })
+  .use(
+    jwt({
+      name: "jwt",
+      secret: process.env.JWT_SECRET || "fallback-secret"
+    })
+  )
+  .onBeforeHandle(async ({ jwt, headers, set }) => {
+    const auth = headers.authorization;
+    if (!auth?.startsWith("Bearer ")) {
+      set.status = 401;
+      return { error: "Unauthorized: Missing or invalid token format" };
+    }
+
+    const token = auth.substring(7);
+    const payload = await jwt.verify(token);
+
+    if (!payload) {
+      set.status = 401;
+      return { error: "Unauthorized: Invalid token" };
+    }
+
+    if ((payload as any).role !== "ADMIN") {
+      set.status = 401;
+      return { error: "Unauthorized: Admin access required" };
+    }
+  });