add first files

apps/api/src/middleware/requireRenterAuth.ts

@@ -0,0 +1,47 @@
+import { Request, Response, NextFunction } from 'express'
+import jwt from 'jsonwebtoken'
+import { prisma } from '../lib/prisma'
+
+export async function requireRenterAuth(req: Request, res: Response, next: NextFunction) {
+  const authHeader = req.headers.authorization
+  const token = authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : null
+
+  if (!token) {
+    return res.status(401).json({ error: 'unauthenticated', message: 'Renter authentication required', statusCode: 401 })
+  }
+
+  try {
+    const payload = jwt.verify(token, process.env.JWT_SECRET!) as { sub: string; type: string }
+    if (payload.type !== 'renter') {
+      return res.status(401).json({ error: 'invalid_token', message: 'Invalid token type', statusCode: 401 })
+    }
+
+    const renter = await prisma.renter.findUnique({ where: { id: payload.sub } })
+    if (!renter || !renter.isActive) {
+      return res.status(401).json({ error: 'unauthenticated', message: 'Renter account not found or inactive', statusCode: 401 })
+    }
+
+    req.renterId = renter.id
+    next()
+  } catch {
+    return res.status(401).json({ error: 'invalid_token', message: 'Invalid or expired token', statusCode: 401 })
+  }
+}
+
+export async function optionalRenterAuth(req: Request, res: Response, next: NextFunction) {
+  const authHeader = req.headers.authorization
+  const token = authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : null
+
+  if (!token) return next()
+
+  try {
+    const payload = jwt.verify(token, process.env.JWT_SECRET!) as { sub: string; type: string }
+    if (payload.type === 'renter') {
+      req.renterId = payload.sub
+    }
+  } catch {
+    // Optional — ignore invalid tokens
+  }
+
+  next()
+}