Jennie Robinson Faber
f34b062f2a
Pre-launch P0 fixes surfaced by docs/specs/events-functional-test-matrix.md (Findings 1, 2, 3). 1. Series-pass bypass (Finding 1 / matrix S1 P3): register.post.js now loads the linked Series when tickets.requiresSeriesTicket is set and rejects drop-in registration unless series.allowIndividualEventTickets is true or the user has a valid pass. Data-integrity 500 if the referenced series is missing. 2. Hidden-event leak (Finding 2 / matrix E11): extract loadPublicEvent into server/utils/loadEvent.js. All five public event endpoints ([id].get, register, tickets/available, tickets/reserve, tickets/purchase) now go through the helper, which 404s when isVisible === false and the requester is not an admin. Admin detection uses a new non-throwing getOptionalMember() in server/utils/auth.js (extracted from the pattern already inlined in api/auth/status.get.js). 3. Deadline enforcement + legacy pricing retirement (Finding 3 / matrix E8): register.post.js and tickets/reserve.post.js delegate gating to validateTicketPurchase (which already covers deadline, cancelled, started, members-only, sold-out, and already-registered); tickets/available.get.js gets an explicit registrationDeadline check. Legacy pricing.paymentRequired 402 branch removed from register.post.js.
119 lines
2.8 KiB
JavaScript
119 lines
2.8 KiB
JavaScript
import jwt from 'jsonwebtoken'
|
|
import Member from '../models/member.js'
|
|
import { connectDB } from './mongoose.js'
|
|
|
|
/**
|
|
* Issue a session JWT and set the auth-token cookie for the given member.
|
|
* Mirrors the cookie options used by verify.post.js.
|
|
*/
|
|
export function setAuthCookie(event, member) {
|
|
const token = jwt.sign(
|
|
{ memberId: member._id.toString(), email: member.email, tv: member.tokenVersion || 0 },
|
|
useRuntimeConfig(event).jwtSecret,
|
|
{ expiresIn: '7d' }
|
|
)
|
|
|
|
setCookie(event, 'auth-token', token, {
|
|
httpOnly: true,
|
|
secure: process.env.NODE_ENV === 'production',
|
|
sameSite: 'lax',
|
|
path: '/',
|
|
maxAge: 60 * 60 * 24 * 7
|
|
})
|
|
}
|
|
|
|
/**
|
|
* Verify JWT from cookie and return the decoded member.
|
|
* Throws 401 if token is missing or invalid.
|
|
*/
|
|
export async function requireAuth(event) {
|
|
await connectDB()
|
|
|
|
const token = getCookie(event, 'auth-token')
|
|
|
|
if (!token) {
|
|
throw createError({
|
|
statusCode: 401,
|
|
statusMessage: 'Authentication required'
|
|
})
|
|
}
|
|
|
|
let decoded
|
|
try {
|
|
decoded = jwt.verify(token, useRuntimeConfig().jwtSecret)
|
|
} catch (err) {
|
|
throw createError({
|
|
statusCode: 401,
|
|
statusMessage: 'Invalid or expired token'
|
|
})
|
|
}
|
|
|
|
const member = await Member.findById(decoded.memberId)
|
|
|
|
if (!member) {
|
|
throw createError({
|
|
statusCode: 401,
|
|
statusMessage: 'Member not found'
|
|
})
|
|
}
|
|
|
|
if (member.status === 'suspended' || member.status === 'cancelled') {
|
|
throw createError({
|
|
statusCode: 403,
|
|
statusMessage: 'Account is ' + member.status
|
|
})
|
|
}
|
|
|
|
// Verify session has not been revoked (tokenVersion incremented on logout)
|
|
if (decoded.tv !== member.tokenVersion) {
|
|
throw createError({
|
|
statusCode: 401,
|
|
statusMessage: 'Session has been revoked'
|
|
})
|
|
}
|
|
|
|
return member
|
|
}
|
|
|
|
/**
|
|
* Return the signed-in Member without throwing.
|
|
* Returns null when no cookie, invalid token, or member not found/inactive.
|
|
* Mirrors the non-throwing JWT check in api/auth/status.get.js.
|
|
*/
|
|
export async function getOptionalMember(event) {
|
|
await connectDB()
|
|
|
|
const token = getCookie(event, 'auth-token')
|
|
if (!token) return null
|
|
|
|
let decoded
|
|
try {
|
|
decoded = jwt.verify(token, useRuntimeConfig(event).jwtSecret)
|
|
} catch {
|
|
return null
|
|
}
|
|
|
|
const member = await Member.findById(decoded.memberId)
|
|
if (!member) return null
|
|
if (member.status === 'suspended' || member.status === 'cancelled') return null
|
|
if (decoded.tv !== member.tokenVersion) return null
|
|
|
|
return member
|
|
}
|
|
|
|
/**
|
|
* Verify JWT and require admin role.
|
|
* Throws 401 if not authenticated, 403 if not admin.
|
|
*/
|
|
export async function requireAdmin(event) {
|
|
const member = await requireAuth(event)
|
|
|
|
if (member.role !== 'admin') {
|
|
throw createError({
|
|
statusCode: 403,
|
|
statusMessage: 'Admin access required'
|
|
})
|
|
}
|
|
|
|
return member
|
|
}
|