38 lines
1.1 KiB
TypeScript
38 lines
1.1 KiB
TypeScript
|
import type { NextRequest } from "next/server";
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Validates a browser-forwarded PocketBase auth token against PocketBase.
|
||
|
|
*
|
||
|
|
* Dashboard auth lives in localStorage, so Route Handlers cannot read it from
|
||
|
|
* cookies. Browser callers send the current PB token in `Authorization`; this
|
||
|
|
* helper asks PB to refresh/validate it instead of trusting or decoding the
|
||
|
|
* token locally.
|
||
|
|
*/
|
||
|
|
export async function assertBrowserSession(req: NextRequest): Promise<void> {
|
||
|
|
const authorization = req.headers.get("authorization") || "";
|
||
|
|
const token = authorization.startsWith("Bearer ")
|
||
|
|
? authorization.slice(7)
|
||
|
|
: authorization;
|
||
|
|
|
||
|
|
if (!token) {
|
||
|
|
throw Object.assign(new Error("Not authenticated."), { status: 401 });
|
||
|
|
}
|
||
|
|
|
||
|
|
const pbUrl =
|
||
|
|
process.env.NEXT_PUBLIC_POCKETBASE_URL || "http://127.0.0.1:8090";
|
||
|
|
const response = await fetch(
|
||
|
|
`${pbUrl.replace(/\/$/, "")}/api/collections/users/auth-refresh`,
|
||
|
|
{
|
||
|
|
method: "POST",
|
||
|
|
headers: { Authorization: token },
|
||
|
|
signal: AbortSignal.timeout(5_000),
|
||
|
|
},
|
||
|
|
);
|
||
|
|
|
||
|
|
if (!response.ok) {
|
||
|
|
throw Object.assign(new Error("Invalid or expired session."), {
|
||
|
|
status: 401,
|
||
|
|
});
|
||
|
|
}
|
||
|
|
}
|