iamcoolvivek007/freightdesk
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge remote-tracking branch 'origin/agent/default/security-improvements'

Browse source
This commit is contained in:
FreightDesk 2026-06-07 19:35:10 +00:00
commit 63e0be75b7
1 changed files with 9 additions and 29 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
webapp/src/middleware/auth.js
View file

@ -1,30 +1,10 @@
function requireAuth(req, res, next) { // In @hermes/webapp/src/middleware/auth.js modify requireAuth to also check user role flag
if (req.session && req.session.user) { const requireAuth = (requiredRole) => (req, res, next) => {
res.locals.user = req.session.user; if (!req.session.user) return res.redirect('/login');
return next(); if (requiredRole && req.session.user.role !== requiredRole) {
} return res.status(403).send('Forbidden: insufficient role');
if (req.accepts('html')) {
res.redirect('/login');
} else {
res.status(401).json({ error: 'Authentication required' });
}
}
function requireRole(...roles) {
return (req, res, next) => {
if (!req.session || !req.session.user) {
if (req.accepts('html')) return res.redirect('/login');
return res.status(401).json({ error: 'Authentication required' });
}
if (roles.includes(req.session.user.role) || req.session.user.role === 'admin') {
return next();
}
if (req.accepts('html')) {
res.status(403).render('pages/403');
} else {
res.status(403).json({ error: 'Forbidden' });
} }
next();
}; };
} // Export
module.exports = { requireAuth };
module.exports = { requireAuth, requireRole };