archetecture security fix

2026-06-11 03:22:12 -04:00
parent 6def9993da
commit 9483750161
3126 changed files with 177194 additions and 37211 deletions
@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireRole = requireRole;
+const authHelpers_1 = require("./authHelpers");
+const ROLE_RANK = {
+    OWNER: 3,
+    MANAGER: 2,
+    AGENT: 1,
+};
+/**
+ * Requires the authenticated employee to have at least `minimumRole`.
+ * Must be applied after `requireCompanyAuth`.
+ */
+function requireRole(minimumRole) {
+    return (req, res, next) => {
+        const employee = req.employee;
+        if (!employee)
+            return (0, authHelpers_1.sendUnauthorized)(res, 'unauthenticated', 'Authentication required');
+        const employeeRank = ROLE_RANK[employee.role] ?? 0;
+        const requiredRank = ROLE_RANK[minimumRole] ?? 99;
+        if (employeeRank < requiredRank) {
+            return (0, authHelpers_1.sendForbidden)(res, 'forbidden', `This action requires the ${minimumRole} role or higher`, {
+                requiredRole: minimumRole,
+                yourRole: employee.role,
+            });
+        }
+        next();
+    };
+}
+//# sourceMappingURL=requireRole.js.map