21 lines
546 B
TypeScript
21 lines
546 B
TypeScript
import type { H3Event } from 'h3';
|
|
|
|
/**
|
|
* Like protectRoute(), but only lets admins through.
|
|
*
|
|
* protectRoute() reads the user from the database on every request, so someone
|
|
* who just stopped being an admin loses the access right away.
|
|
*/
|
|
export const protectAdminRoute = async (event: H3Event) => {
|
|
const sessionData = await protectRoute(event);
|
|
|
|
if (sessionData.user.role !== 'admin') {
|
|
throw createError({
|
|
statusCode: 403,
|
|
statusMessage: 'Forbidden',
|
|
});
|
|
}
|
|
|
|
return sessionData;
|
|
};
|