26 lines
675 B
JavaScript
26 lines
675 B
JavaScript
|
'use strict';
|
||
|
|
|
||
|
|
function isApi(req) {
|
||
|
|
return (req.originalUrl || req.url).startsWith('/api/');
|
||
|
|
}
|
||
|
|
|
||
|
|
function requireAuth(req, res, next) {
|
||
|
|
if (req.session && req.session.user) return next();
|
||
|
|
if (isApi(req)) {
|
||
|
|
return res.status(401).json({ error: 'Not authenticated' });
|
||
|
|
}
|
||
|
|
return res.redirect('/login.html');
|
||
|
|
}
|
||
|
|
|
||
|
|
function requireAdmin(req, res, next) {
|
||
|
|
if (req.session && req.session.user && req.session.user.role === 'admin') {
|
||
|
|
return next();
|
||
|
|
}
|
||
|
|
if (isApi(req)) {
|
||
|
|
return res.status(403).json({ error: 'Admin access required' });
|
||
|
|
}
|
||
|
|
return res.status(403).send('Forbidden: admin access required.');
|
||
|
|
}
|
||
|
|
|
||
|
|
module.exports = { requireAuth, requireAdmin };
|