JetSprow/J-Board-Lite
1
0
Fork 0
mirror of https://github.com/JetSprow/J-Board-Lite.git synced 2026-05-01 01:14:10 +05:30
Code Issues Packages Projects Releases Wiki Activity

fix: harden secrets and session checks

Browse Source
This commit is contained in:
JetSprow
2026-04-29 17:18:36 +10:00
parent 69be1d6fcc
commit 58fa4fefa4
44 changed files with 454 additions and 154 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
src/lib/require-auth.ts
View File

@@ -1,9 +1,29 @@
import { getServerSession } from "next-auth";
import { authOptions } from "./auth";
import { prisma } from "./prisma";
import { getActiveSubscriptionRiskRestriction } from "@/services/subscription-risk-review";
export async function requireAdmin() {
export async function getActiveSession() {
const session = await getServerSession(authOptions);
if (!session?.user?.id) return null;
const user = await prisma.user.findUnique({
where: { id: session.user.id },
select: { id: true, email: true, name: true, role: true, status: true },
});
if (!user || user.status !== "ACTIVE") return null;
session.user.id = user.id;
session.user.email = user.email;
session.user.name = user.name;
session.user.role = user.role;
return session;
}
export async function requireAdmin() {
const session = await getActiveSession();
if (!session || session.user.role !== "ADMIN") {
throw new Error("无权限");
}
@@ -11,7 +31,7 @@ export async function requireAdmin() {
}
export async function requireAuth(options: { allowDuringRiskRestriction?: boolean } = {}) {
const session = await getServerSession(authOptions);
const session = await getActiveSession();
if (!session) {
throw new Error("未登录");
}