x

apps/backend/src/middleware/auth.test.ts

@@ -0,0 +1,34 @@
+import { describe, expect, test } from 'bun:test'
+import { requireAdmin } from './auth'
+
+function context(authorization?: string, payload: unknown = null) {
+  return {
+    jwt: { verify: async () => payload },
+    headers: { authorization },
+    set: { status: 200 },
+  }
+}
+
+describe('requireAdmin', () => {
+  test('rejects a missing bearer token', async () => {
+    const request = context()
+    expect(await requireAdmin(request)).toEqual({
+      error: 'Unauthorized: Missing or invalid token format',
+    })
+    expect(request.set.status).toBe(401)
+  })
+
+  test('rejects a non-admin token', async () => {
+    const request = context('Bearer customer-token', { role: 'CUSTOMER' })
+    expect(await requireAdmin(request)).toEqual({
+      error: 'Unauthorized: Admin access required',
+    })
+    expect(request.set.status).toBe(401)
+  })
+
+  test('allows an admin token', async () => {
+    const request = context('Bearer admin-token', { role: 'ADMIN' })
+    expect(await requireAdmin(request)).toBeUndefined()
+    expect(request.set.status).toBe(200)
+  })
+})

apps/backend/src/middleware/auth.ts

@@ -1,6 +1,27 @@
 import { Elysia } from "elysia";
 import { jwt } from "@elysiajs/jwt";
 
+export async function requireAdmin({ jwt, headers, set }: any) {
+  const auth = headers.authorization;
+  if (!auth?.startsWith("Bearer ")) {
+    set.status = 401;
+    return { error: "Unauthorized: Missing or invalid token format" };
+  }
+
+  const token = auth.substring(7);
+  const payload = await jwt.verify(token);
+
+  if (!payload) {
+    set.status = 401;
+    return { error: "Unauthorized: Invalid token" };
+  }
+
+  if ((payload as any).role !== "ADMIN") {
+    set.status = 401;
+    return { error: "Unauthorized: Admin access required" };
+  }
+}
+
 export const adminOnly = new Elysia({ name: "adminOnly" })
   .use(
     jwt({
@@ -8,23 +29,4 @@ export const adminOnly = new Elysia({ name: "adminOnly" })
       secret: process.env.JWT_SECRET || "fallback-secret"
     })
   )
-  .onBeforeHandle(async ({ jwt, headers, set }) => {
-    const auth = headers.authorization;
-    if (!auth?.startsWith("Bearer ")) {
-      set.status = 401;
-      return { error: "Unauthorized: Missing or invalid token format" };
-    }
-
-    const token = auth.substring(7);
-    const payload = await jwt.verify(token);
-
-    if (!payload) {
-      set.status = 401;
-      return { error: "Unauthorized: Invalid token" };
-    }
-
-    if ((payload as any).role !== "ADMIN") {
-      set.status = 401;
-      return { error: "Unauthorized: Admin access required" };
-    }
-  });
+  .onBeforeHandle(requireAdmin);