Bugfixing

server/api/membership/applications.get.js

@@ -1,15 +1,11 @@
 import fs from 'fs/promises'
 import path from 'path'
+import { requireUserWithAnyRole } from '../../utils/auth.js'
 import { decryptObject } from '../../utils/encryption.js'
 
 export default defineEventHandler(async (event) => {
   try {
-    // Nur Vorstand oder Admin darf Mitgliedschaftsantraege lesen
-    const token = getCookie(event, 'auth_token')
-    const currentUser = token ? await getUserFromToken(token) : null
-    if (!currentUser || !hasAnyRole(currentUser, 'admin', 'vorstand')) {
-      throw createError({ statusCode: 403, statusMessage: 'Zugriff verweigert' })
-    }
+    await requireUserWithAnyRole(event, 'admin', 'vorstand')
 
     const config = useRuntimeConfig()
     const encryptionKey = config.encryptionKey || 'local_development_encryption_key_change_in_production'

server/api/membership/update-status.put.js

@@ -1,10 +1,13 @@
 import fs from 'fs/promises'
 import path from 'path'
+import { requireUserWithAnyRole } from '../../utils/auth.js'
 import { decryptObject } from '../../utils/encryption.js'
 import { saveMember } from '../../utils/members.js'
 
 export default defineEventHandler(async (event) => {
   try {
+    await requireUserWithAnyRole(event, 'admin', 'vorstand')
+
     const { id, status, notes } = await readBody(event)
     
     if (!id || !status) {

server/utils/auth.js

@@ -399,6 +399,42 @@ export async function getUserFromToken(token) {
   return user
 }
 
+export function getTokenFromEvent(event) {
+  return getCookie(event, 'auth_token') || getHeader(event, 'authorization')?.replace(/^Bearer\s+/i, '')
+}
+
+export async function requireAuthenticatedUser(event) {
+  const token = getTokenFromEvent(event)
+  if (!token) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: 'Nicht authentifiziert'
+    })
+  }
+
+  const user = await getUserFromToken(token)
+  if (!user) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: 'Ungültige Sitzung'
+    })
+  }
+
+  return user
+}
+
+export async function requireUserWithAnyRole(event, ...roles) {
+  const user = await requireAuthenticatedUser(event)
+  if (!hasAnyRole(user, ...roles)) {
+    throw createError({
+      statusCode: 403,
+      statusMessage: 'Zugriff verweigert'
+    })
+  }
+
+  return user
+}
+
 // Create session
 export async function createSession(userId, token) {
   const sessions = await readSessions()