27 lines
740 B
TypeScript
27 lines
740 B
TypeScript
import type { H3Event } from 'h3';
|
|
import { db } from '~~/server/lib/db';
|
|
|
|
/**
|
|
* Like protectRoute(), but only lets admins through.
|
|
*
|
|
* The role is read from the database: the session cookie keeps a copy of the
|
|
* user for a few minutes, and someone who just stopped being an admin should
|
|
* not keep the access for that long.
|
|
*/
|
|
export const protectAdminRoute = async (event: H3Event) => {
|
|
await protectRoute(event);
|
|
|
|
const account = await db.query.users.findFirst({
|
|
where: {
|
|
id: event.context.user!.id as string,
|
|
},
|
|
});
|
|
|
|
if (account?.role !== 'admin' || account.banned) {
|
|
throw createError({
|
|
statusCode: 403,
|
|
statusMessage: 'Forbidden',
|
|
});
|
|
}
|
|
};
|