60 lines
2.1 KiB
TypeScript
60 lines
2.1 KiB
TypeScript
import type { MiddlewareHandler } from "hono";
|
|
import { AUTH_CODES, AuthError } from "../error-codes/error-codes.js";
|
|
import { getAuthInstruments } from "../otel/instruments.js";
|
|
import "./context-augmentation.js";
|
|
|
|
/**
|
|
* Construct a `requireRole(...)` middleware. Depends on `requireAuth`
|
|
* upstream — if no principal is present the middleware throws
|
|
* `AUTH_UNAUTHENTICATED` (401). When a principal exists but its
|
|
* `roles` do not intersect the supplied set, throws
|
|
* `AUTH_INSUFFICIENT_ROLE` (403) carrying `context.required: roles`.
|
|
*
|
|
* Increments `auth.role_check_total{outcome}` on every call.
|
|
*/
|
|
export function requireRole(...roles: readonly string[]): MiddlewareHandler {
|
|
if (roles.length === 0) {
|
|
throw new AuthError(
|
|
AUTH_CODES.INVALID_INPUT,
|
|
"requireRole(): at least one role is required",
|
|
{ context: { statusCode: 500 } }
|
|
);
|
|
}
|
|
const requiredSet = new Set(roles);
|
|
return async function requireRoleHandler(c, next) {
|
|
const instruments = getAuthInstruments();
|
|
const principal = c.get("user");
|
|
if (principal === null || principal === undefined) {
|
|
instruments.roleCheckTotal.add(1, { outcome: "denied" });
|
|
throw new AuthError(
|
|
AUTH_CODES.UNAUTHENTICATED,
|
|
"Authentication required",
|
|
{ context: { statusCode: 401 } }
|
|
);
|
|
}
|
|
let allowed = false;
|
|
for (const role of principal.roles) {
|
|
if (requiredSet.has(role)) {
|
|
allowed = true;
|
|
break;
|
|
}
|
|
}
|
|
if (!allowed) {
|
|
instruments.roleCheckTotal.add(1, { outcome: "denied" });
|
|
throw new AuthError(
|
|
AUTH_CODES.INSUFFICIENT_ROLE,
|
|
`Required one of: ${roles.join(", ")}`,
|
|
{
|
|
context: {
|
|
statusCode: 403,
|
|
required: [...roles],
|
|
actual: [...principal.roles],
|
|
},
|
|
}
|
|
);
|
|
}
|
|
instruments.roleCheckTotal.add(1, { outcome: "allowed" });
|
|
await next();
|
|
};
|
|
}
|