/home/techb158/balavpn.abdallabala.com/src/lib
Edit: /home/techb158/balavpn.abdallabala.com/src/lib/request-context.js (3725B)
const { prisma } = require("./prisma");
async function getActorFromRequest(request) {
const cookie = request.headers.get("cookie") || "";
const sessionMatch = cookie.match(/cosmic_session=([^;]+)/);
if (sessionMatch) {
const session = await prisma.session.findUnique({
where: { token: sessionMatch[1] },
include: {
user: {
include: {
memberships: {
where: { status: "ACTIVE" },
include: { role: true, organization: true }
}
}
}
}
});
if (session && session.expiresAt > new Date()) {
return session.user;
}
if (session) {
await prisma.session.delete({ where: { id: session.id } }).catch(() => {});
}
}
const email = request.headers.get("x-cosmic-user-email") || process.env.COSMIC_BOOTSTRAP_EMAIL || "super-owner@cosmic.local";
const user = await prisma.user.findUnique({
where: { email },
include: {
memberships: {
where: { status: "ACTIVE" },
include: {
role: true,
organization: true
}
}
}
});
if (!user) {
const error = new Error(`Unknown actor: ${email}`);
error.status = 401;
throw error;
}
return user;
}
async function requireSuperUser(request) {
const { isSuperUser } = require("../domain/permissions");
const actor = await getActorFromRequest(request);
if (!isSuperUser(actor)) {
const error = new Error("Super Admin or Super Owner access required.");
error.status = 403;
throw error;
}
return actor;
}
async function requireSuperOwner(request) {
const { requirePlatformRole } = require("../domain/permissions");
const actor = await getActorFromRequest(request);
requirePlatformRole(actor, "SUPER_OWNER");
return actor;
}
function getMembership(actor, organizationId) {
return actor.memberships.find(item => item.organizationId === organizationId && item.status === "ACTIVE");
}
async function requireOrganizationActor(request, organizationId, permission = "project:read") {
const { hasPermission, isSuperUser } = require("../domain/permissions");
const actor = await getActorFromRequest(request);
// Super Owner: full access to all organizations
if (actor.platformRole === "SUPER_OWNER") {
const org = await prisma.organization.findUnique({ where: { id: organizationId } });
if (!org) {
const error = new Error("Organization not found.");
error.status = 404;
throw error;
}
return { actor, membership: null, organization: org, isSuperUser: true };
}
// Super Admin: access only to assigned organizations
if (actor.platformRole === "SUPER_ADMIN") {
const access = await prisma.organizationAccess.findUnique({
where: { userId_organizationId: { userId: actor.id, organizationId } }
});
if (!access) {
const error = new Error("Super Admin is not assigned to this organization.");
error.status = 403;
throw error;
}
const org = await prisma.organization.findUnique({ where: { id: organizationId } });
return { actor, membership: null, organization: org, isSuperUser: true };
}
const membership = getMembership(actor, organizationId);
if (!membership) {
const error = new Error("Actor is not a member of this organization.");
error.status = 403;
throw error;
}
if (!hasPermission(membership.role.permissions, permission)) {
const error = new Error(`Permission denied: ${permission}`);
error.status = 403;
throw error;
}
return { actor, membership, organization: membership.organization };
}
module.exports = {
getActorFromRequest,
requireOrganizationActor,
requireSuperUser,
requireSuperOwner
};