85 lines
2.1 KiB
TypeScript
85 lines
2.1 KiB
TypeScript
/* eslint-disable @typescript-eslint/no-explicit-any */
|
|
import jwt, { type JWTPayloadSpec } from '@elysiajs/jwt'
|
|
import Elysia from 'elysia'
|
|
import { prisma } from '../lib/prisma'
|
|
|
|
const secret = process.env.JWT_SECRET
|
|
|
|
if (!secret) {
|
|
throw new Error('JWT_SECRET is not defined')
|
|
}
|
|
|
|
export function apiAuth(app: Elysia) {
|
|
if (!secret) {
|
|
throw new Error('JWT_SECRET is not defined')
|
|
}
|
|
return app
|
|
.use(
|
|
jwt({
|
|
name: 'jwt',
|
|
secret,
|
|
})
|
|
)
|
|
.derive(async ({ cookie, headers, jwt, request }) => {
|
|
let token: string | undefined
|
|
|
|
// 🔸 Ambil token dari Cookie
|
|
if (cookie?.token?.value) token = cookie.token.value as string
|
|
|
|
// 🔸 Ambil token dari Header (case-insensitive)
|
|
const possibleHeaders = [
|
|
'authorization',
|
|
'Authorization',
|
|
'x-token',
|
|
'X-Token',
|
|
]
|
|
|
|
for (const key of possibleHeaders) {
|
|
const value = headers[key]
|
|
if (typeof value === 'string') {
|
|
token = value.startsWith('Bearer ') ? value.slice(7) : value
|
|
break
|
|
}
|
|
}
|
|
|
|
// 🔸 Tidak ada token
|
|
if (!token) {
|
|
console.warn(`[AUTH] No token found for ${request.method} ${request.url}`)
|
|
return { user: null }
|
|
}
|
|
|
|
// 🔸 Verifikasi token
|
|
try {
|
|
const decoded = (await jwt.verify(token)) as JWTPayloadSpec
|
|
|
|
if (!decoded?.sub) {
|
|
console.warn('[AUTH] Token missing sub field:', decoded)
|
|
return { user: null }
|
|
}
|
|
|
|
const user = await prisma.user.findUnique({
|
|
where: { id: decoded.sub as string },
|
|
})
|
|
|
|
if (!user) {
|
|
console.warn('[AUTH] User not found for sub:', decoded.sub)
|
|
return { user: null }
|
|
}
|
|
|
|
return { user }
|
|
} catch (err) {
|
|
console.warn('[AUTH] Invalid JWT token:', err)
|
|
return { user: null }
|
|
}
|
|
})
|
|
.onBeforeHandle(({ user, set, request }) => {
|
|
if (!user) {
|
|
console.warn(
|
|
`[AUTH] Unauthorized access: ${request.method} ${request.url}`
|
|
)
|
|
set.status = 401
|
|
return { error: 'Unauthorized' }
|
|
}
|
|
})
|
|
}
|