19 lines
868 B
TypeScript
19 lines
868 B
TypeScript
import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
|
|
import { and, eq, isNull } from "drizzle-orm";
|
|
import { authUsers } from "../../db/schema/auth_users";
|
|
|
|
export async function requireSystemAdmin(server: FastifyInstance, req: FastifyRequest, reply: FastifyReply) {
|
|
if (!req.user?.user_id) {
|
|
reply.code(401).send({ error: "Unauthorized" });
|
|
return null;
|
|
}
|
|
// Read the current global role; tenant roles and stale JWT claims do not grant access.
|
|
const [user] = await server.db.select({ id: authUsers.id, email: authUsers.email, is_admin: authUsers.is_admin })
|
|
.from(authUsers).where(and(eq(authUsers.id, req.user.user_id), isNull(authUsers.archived_at))).limit(1);
|
|
if (!user?.is_admin) {
|
|
reply.code(403).send({ error: "Admin access required" });
|
|
return null;
|
|
}
|
|
return user;
|
|
}
|