Bugfixing

server/utils/auth.js

@@ -399,6 +399,42 @@ export async function getUserFromToken(token) {
   return user
 }
 
+export function getTokenFromEvent(event) {
+  return getCookie(event, 'auth_token') || getHeader(event, 'authorization')?.replace(/^Bearer\s+/i, '')
+}
+
+export async function requireAuthenticatedUser(event) {
+  const token = getTokenFromEvent(event)
+  if (!token) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: 'Nicht authentifiziert'
+    })
+  }
+
+  const user = await getUserFromToken(token)
+  if (!user) {
+    throw createError({
+      statusCode: 401,
+      statusMessage: 'Ungültige Sitzung'
+    })
+  }
+
+  return user
+}
+
+export async function requireUserWithAnyRole(event, ...roles) {
+  const user = await requireAuthenticatedUser(event)
+  if (!hasAnyRole(user, ...roles)) {
+    throw createError({
+      statusCode: 403,
+      statusMessage: 'Zugriff verweigert'
+    })
+  }
+
+  return user
+}
+
 // Create session
 export async function createSession(userId, token) {
   const sessions = await readSessions()