v_2.3

middleware/auth.js

@@ -0,0 +1,25 @@
+'use strict';
+
+function isApi(req) {
+  return (req.originalUrl || req.url).startsWith('/api/');
+}
+
+function requireAuth(req, res, next) {
+  if (req.session && req.session.user) return next();
+  if (isApi(req)) {
+    return res.status(401).json({ error: 'Not authenticated' });
+  }
+  return res.redirect('/login.html');
+}
+
+function requireAdmin(req, res, next) {
+  if (req.session && req.session.user && req.session.user.role === 'admin') {
+    return next();
+  }
+  if (isApi(req)) {
+    return res.status(403).json({ error: 'Admin access required' });
+  }
+  return res.status(403).send('Forbidden: admin access required.');
+}
+
+module.exports = { requireAuth, requireAdmin };