feat: admin controls

server/api/account/sessions/[id].delete.ts

@@ -1,17 +1,9 @@
 import { and, eq } from 'drizzle-orm';
 import { sessions } from '~~/drizzle/schema';
-import { auth } from '~~/lib/auth';
 import { db } from '~~/server/lib/db';
 
 export default defineEventHandler(async (event) => {
-    const sessionData = await auth.api.getSession({ headers: event.headers });
-
-    if (sessionData === null) {
-        throw createError({
-            statusCode: 401,
-            statusMessage: 'Unauthorized',
-        });
-    }
+    const sessionData = await protectRoute(event);
 
     const id = getRouterParam(event, 'id')!;
 

server/api/account/sessions/index.get.ts

@@ -1,4 +1,3 @@
-import { auth } from '~~/lib/auth';
 import { db } from '~~/server/lib/db';
 
 /**
@@ -6,14 +5,7 @@ import { db } from '~~/server/lib/db';
  * out on purpose: the client only ever needs the id to sign a device out.
  */
 export default defineEventHandler(async (event) => {
-    const sessionData = await auth.api.getSession({ headers: event.headers });
-
-    if (sessionData === null) {
-        throw createError({
-            statusCode: 401,
-            statusMessage: 'Unauthorized',
-        });
-    }
+    const sessionData = await protectRoute(event);
 
     const result = await db.query.sessions.findMany({
         where: {