Tonne of debugging - getting ready for the production builds

api/dist/modules/media/middleware/auth.d.ts

@@ -0,0 +1,27 @@
+import { FastifyRequest, FastifyReply } from 'fastify';
+import { UserRole } from '@prisma/client';
+declare module 'fastify' {
+    interface FastifyRequest {
+        user?: {
+            id: string;
+            email: string;
+            role: UserRole;
+        };
+    }
+}
+/**
+ * Authenticate user via V2 JWT access token
+ * Verifies token and checks user status in Prisma database
+ */
+export declare function authenticate(request: FastifyRequest, reply: FastifyReply): Promise<void>;
+/**
+ * Require admin role (SUPER_ADMIN, INFLUENCE_ADMIN, or MAP_ADMIN)
+ * Also checks auth, so no need to use authenticate() separately
+ */
+export declare function requireAdminRole(request: FastifyRequest, reply: FastifyReply): Promise<void>;
+/**
+ * Optional authentication - attach user if token present, but don't require it
+ * Used for public endpoints that want to know if user is logged in
+ */
+export declare function optionalAuth(request: FastifyRequest, _reply: FastifyReply): Promise<void>;
+//# sourceMappingURL=auth.d.ts.map

api/dist/modules/media/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../src/modules/media/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvD,OAAO,EAAE,QAAQ,EAAc,MAAM,gBAAgB,CAAC;AAKtD,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,IAAI,CAAC,EAAE;YACL,EAAE,EAAE,MAAM,CAAC;YACX,KAAK,EAAE,MAAM,CAAC;YACd,IAAI,EAAE,QAAQ,CAAC;SAChB,CAAC;KACH;CACF;AAQD;;;GAGG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,CAAC,CA+Df;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAiCf"}

api/dist/modules/media/middleware/auth.js

@@ -0,0 +1,128 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authenticate = authenticate;
+exports.requireAdminRole = requireAdminRole;
+exports.optionalAuth = optionalAuth;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const client_1 = require("@prisma/client");
+const database_1 = require("../../../config/database");
+const env_1 = require("../../../config/env");
+/**
+ * Authenticate user via V2 JWT access token
+ * Verifies token and checks user status in Prisma database
+ */
+async function authenticate(request, reply) {
+    const authHeader = request.headers.authorization;
+    if (!authHeader?.startsWith('Bearer ')) {
+        return reply.status(401).send({
+            error: 'Authentication required',
+            code: 'AUTH_REQUIRED'
+        });
+    }
+    const token = authHeader.substring(7);
+    // Verify JWT with V2 access secret
+    let payload;
+    try {
+        payload = jsonwebtoken_1.default.verify(token, env_1.env.JWT_ACCESS_SECRET);
+    }
+    catch (error) {
+        return reply.status(401).send({
+            error: 'Invalid or expired token',
+            code: 'INVALID_TOKEN'
+        });
+    }
+    // Verify user still exists and is active
+    const user = await database_1.prisma.user.findUnique({
+        where: { id: payload.id },
+        select: {
+            id: true,
+            email: true,
+            role: true,
+            status: true,
+            expiresAt: true,
+        },
+    });
+    if (!user) {
+        return reply.status(401).send({
+            error: 'User not found',
+            code: 'USER_NOT_FOUND'
+        });
+    }
+    if (user.status !== client_1.UserStatus.ACTIVE) {
+        return reply.status(403).send({
+            error: `Account is ${user.status.toLowerCase()}`,
+            code: 'ACCOUNT_INACTIVE'
+        });
+    }
+    // Check expiration if set
+    if (user.expiresAt && user.expiresAt < new Date()) {
+        return reply.status(403).send({
+            error: 'Account has expired',
+            code: 'ACCOUNT_EXPIRED'
+        });
+    }
+    // Attach user to request
+    request.user = {
+        id: user.id,
+        email: user.email,
+        role: user.role,
+    };
+}
+/**
+ * Require admin role (SUPER_ADMIN, INFLUENCE_ADMIN, or MAP_ADMIN)
+ * Also checks auth, so no need to use authenticate() separately
+ */
+async function requireAdminRole(request, reply) {
+    // First authenticate
+    await authenticate(request, reply);
+    // If authenticate sent a response, stop here
+    if (reply.sent) {
+        return;
+    }
+    // Check admin role (allow all admin roles)
+    const ADMIN_ROLES = ['SUPER_ADMIN', 'INFLUENCE_ADMIN', 'MAP_ADMIN'];
+    if (!request.user || !ADMIN_ROLES.includes(request.user.role)) {
+        return reply.status(403).send({
+            error: 'Admin access required',
+            code: 'ADMIN_REQUIRED'
+        });
+    }
+}
+/**
+ * Optional authentication - attach user if token present, but don't require it
+ * Used for public endpoints that want to know if user is logged in
+ */
+async function optionalAuth(request, _reply) {
+    const authHeader = request.headers.authorization;
+    if (!authHeader?.startsWith('Bearer ')) {
+        return;
+    }
+    const token = authHeader.substring(7);
+    try {
+        const payload = jsonwebtoken_1.default.verify(token, env_1.env.JWT_ACCESS_SECRET);
+        // Verify user exists and is active
+        const user = await database_1.prisma.user.findUnique({
+            where: { id: payload.id },
+            select: {
+                id: true,
+                email: true,
+                role: true,
+                status: true,
+            },
+        });
+        if (user && user.status === client_1.UserStatus.ACTIVE) {
+            request.user = {
+                id: user.id,
+                email: user.email,
+                role: user.role,
+            };
+        }
+    }
+    catch {
+        // Invalid token, just ignore and continue without user
+    }
+}
+//# sourceMappingURL=auth.js.map

api/dist/modules/media/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../../src/modules/media/middleware/auth.ts"],"names":[],"mappings":";;;;;AA2BA,oCAkEC;AAMD,4CAoBC;AAMD,oCAoCC;AAhKD,gEAA+B;AAC/B,2CAAsD;AACtD,uDAAkD;AAClD,6CAA0C;AAmB1C;;;GAGG;AACI,KAAK,UAAU,YAAY,CAChC,OAAuB,EACvB,KAAmB;IAEnB,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAEjD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC5B,KAAK,EAAE,yBAAyB;YAChC,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAEtC,mCAAmC;IACnC,IAAI,OAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAG,CAAC,iBAAiB,CAAiB,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC5B,KAAK,EAAE,0BAA0B;YACjC,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;IACL,CAAC;IAED,yCAAyC;IACzC,MAAM,IAAI,GAAG,MAAM,iBAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACxC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE;QACzB,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI;SAChB;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC5B,KAAK,EAAE,gBAAgB;YACvB,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,mBAAU,CAAC,MAAM,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC5B,KAAK,EAAE,cAAc,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE;YAChD,IAAI,EAAE,kBAAkB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,0BAA0B;IAC1B,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC5B,KAAK,EAAE,qBAAqB;YAC5B,IAAI,EAAE,iBAAiB;SACxB,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB;IACzB,OAAO,CAAC,IAAI,GAAG;QACb,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAgB;KAC5B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CACpC,OAAuB,EACvB,KAAmB;IAEnB,qBAAqB;IACrB,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEnC,6CAA6C;IAC7C,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IAED,2CAA2C;IAC3C,MAAM,WAAW,GAAe,CAAC,aAAa,EAAE,iBAAiB,EAAE,WAAW,CAAC,CAAC;IAChF,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC5B,KAAK,EAAE,uBAAuB;YAC9B,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,YAAY,CAChC,OAAuB,EACvB,MAAoB;IAEpB,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAEjD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAEtC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAG,CAAC,iBAAiB,CAAiB,CAAC;QAEzE,mCAAmC;QACnC,MAAM,IAAI,GAAG,MAAM,iBAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YACxC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE;YACzB,MAAM,EAAE;gBACN,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,mBAAU,CAAC,MAAM,EAAE,CAAC;YAC9C,OAAO,CAAC,IAAI,GAAG;gBACb,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAgB;aAC5B,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;AACH,CAAC"}