[{"_1":2,"_175":-5,"_176":-5},"loaderData",{"_3":4,"_92":93},"root",{"_5":6,"_35":36,"_65":66},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":32,"_33":20,"_34":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","notificationCount",0,"flagDenols","isTeamOrgMember","ENV",{"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58,"_59":60,"_61":62,"_63":64},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","79f79f5ed57d7b797958358e03e52c65090a3729","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_67":68},"__internal_clerk_state",{"_69":70,"_71":46,"_72":73,"_74":73,"_75":20,"_76":73,"_77":73,"_78":73,"_79":73,"_80":81,"_90":20,"_91":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_82":20,"_19":20,"_83":73,"_84":85,"_86":73,"_87":46,"_88":20,"_89":73},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_94":95,"_96":97,"_98":99,"_100":101,"_150":151,"_172":173,"_174":-5},"handle","rohitr21","name","untitled-4063","path","backend/middleware/auth.ts","project",{"_102":103,"_96":97,"_104":105,"_106":-5,"_107":20,"_108":109,"_110":-5,"_111":-5,"_12":112,"_113":114,"_115":116,"_117":116,"_118":-5,"_119":32,"_14":120,"_121":122,"_123":122,"_124":125,"_126":125,"_127":125,"_128":122,"_129":122,"_23":130,"_133":134,"_136":137,"_149":20},"id","c0cebf96-3ee9-11f0-8953-76b3cceeab13","createdAt",["D",1748783413154],"deletedAt","legacyEnvVars","privacy","public","description","imageUrl","b022d420-3ee9-11f0-ad5b-814c56c8abb0","pinnedFileId","95790580-3eea-11f0-bdac-76b3cceeab13","pinPreview",true,"pinMigrated","screenshotVersion","likeCount","46791913-9054-4ab5-8a4e-f882e074951c","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_94":95,"_131":132},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoiZGVmYXVsdCIsImlpZCI6Imluc18yTm10cGhQUklwU0tqZHNiOHNnNGd2ZjJURFUiLCJyaWQiOiJ1c2VyXzJ4dU1DNlRJUkY3a3IxSDVjOXlCYXg3ekhSNSJ9","org",{"_94":95,"_135":132,"_12":112},"avatar","branch",{"_138":139,"_96":44,"_102":140,"_141":103,"_142":-5,"_143":-5,"_144":-5,"_145":-5,"_146":-5,"_147":97,"_148":95},"version",45,"c0cf0514-3ee9-11f0-8953-76b3cceeab13","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","file",{"_102":152,"_96":153,"_154":155,"_156":157,"_158":140,"_159":139,"_160":116,"_104":161,"_138":162,"_163":164,"_165":166,"_167":20,"_168":-5,"_98":169},"33fa6e40-3eed-11f0-b2f3-76b3cceeab13","auth.ts","fileId","800d62f4-3eea-11f0-91cf-76b3cceeab13","parentId","69f736ae-e536-4f9c-9f55-5b0f4175f87a","branchId","branchVersion","latest",["D",1748784894858],2,"fileType","script","content","// Authentication middleware for the GYM Management System\n\nimport { auth } from \"../database/firebase.ts\";\nimport { userModel } from \"../database/models.ts\";\nimport { logger } from \"../utils/logger.ts\";\nimport { UserRole } from \"../../shared/types.ts\";\nimport type { Context } from \"https://esm.sh/hono@3.11.7\";\n\nexport interface AuthenticatedUser {\n uid: string;\n email: string;\n role: UserRole;\n emailVerified: boolean;\n}\n\n// Extend Hono context to include user\ndeclare module \"https://esm.sh/hono@3.11.7\" {\n interface Context {\n user?: AuthenticatedUser;\n }\n}\n\n// Extract token from Authorization header\nfunction extractToken(authHeader: string | null): string | null {\n if (!authHeader) return null;\n \n const parts = authHeader.split(' ');\n if (parts.length !== 2 || parts[0] !== 'Bearer') {\n return null;\n }\n \n return parts[1];\n}\n\n// Verify Firebase ID token\nasync function verifyFirebaseToken(token: string): Promise {\n try {\n // Note: In a real implementation, you would use Firebase Admin SDK\n // This is a simplified version for demonstration\n // For now, we'll do basic token validation\n if (!token || token.length < 10) {\n throw new Error('Invalid token format');\n }\n \n // Mock token verification - in production use Firebase Admin SDK\n return {\n uid: 'demo-user-id',\n email: 'demo@example.com'\n };\n } catch (error) {\n logger.security('Invalid Firebase token', { error: error.message });\n throw new Error('Invalid authentication token');\n }\n}\n\n// Get user data from database\nasync function getUserData(uid: string): Promise {\n try {\n const user = await userModel.findById(uid);\n if (!user) {\n logger.warn(`User not found in database: ${uid}`);\n return null;\n }\n \n return {\n uid: user.id,\n email: user.email,\n role: user.role,\n emailVerified: true // Assuming Firebase handles email verification\n };\n } catch (error) {\n logger.error('Failed to get user data', { uid, error: error.message });\n return null;\n }\n}\n\n// Main authentication middleware\nexport async function authenticate(c: Context, next: () => Promise) {\n const requestLogger = logger.audit.bind(logger);\n const ip = c.req.header('x-forwarded-for') || c.req.header('x-real-ip') || 'unknown';\n const userAgent = c.req.header('user-agent') || 'unknown';\n \n try {\n const authHeader = c.req.header('Authorization');\n const token = extractToken(authHeader);\n \n if (!token) {\n logger.security('Missing authentication token', { \n path: c.req.path,\n method: c.req.method,\n ip,\n userAgent \n });\n \n return c.json({ \n success: false, \n error: 'Authentication required' \n }, 401);\n }\n \n // Verify the token\n const decodedToken = await verifyFirebaseToken(token);\n \n // Get user data from database\n const userData = await getUserData(decodedToken.uid);\n \n if (!userData) {\n logger.security('User not found in database', { \n uid: decodedToken.uid,\n path: c.req.path,\n ip,\n userAgent \n });\n \n return c.json({ \n success: false, \n error: 'User not found' \n }, 401);\n }\n \n // Add user to context\n c.user = userData;\n \n // Log successful authentication\n logger.audit(\n 'authenticate',\n 'auth',\n userData.uid,\n { path: c.req.path, method: c.req.method },\n ip,\n userAgent\n );\n \n await next();\n \n } catch (error) {\n logger.security('Authentication failed', { \n error: error.message,\n path: c.req.path,\n method: c.req.method,\n ip,\n userAgent \n });\n \n return c.json({ \n success: false, \n error: 'Authentication failed' \n }, 401);\n }\n}\n\n// Role-based authorization middleware\nexport function authorize(...allowedRoles: UserRole[]) {\n return async (c: Context, next: () => Promise) => {\n if (!c.user) {\n logger.security('Authorization attempted without authentication', {\n path: c.req.path,\n method: c.req.method\n });\n \n return c.json({ \n success: false, \n error: 'Authentication required' \n }, 401);\n }\n \n if (!allowedRoles.includes(c.user.role)) {\n logger.security('Unauthorized access attempt', {\n userId: c.user.uid,\n userRole: c.user.role,\n requiredRoles: allowedRoles,\n path: c.req.path,\n method: c.req.method\n });\n \n return c.json({ \n success: false, \n error: 'Insufficient permissions' \n }, 403);\n }\n \n // Log successful authorization\n logger.audit(\n 'authorize',\n 'auth',\n c.user.uid,\n { \n role: c.user.role,\n allowedRoles,\n path: c.req.path,\n method: c.req.method \n }\n );\n \n await next();\n };\n}\n\n// Admin-only middleware\nexport const requireAdmin = authorize(UserRole.ADMIN);\n\n// Member or Admin middleware\nexport const requireMemberOrAdmin = authorize(UserRole.MEMBER, UserRole.ADMIN);\n\n// Any authenticated user middleware\nexport const requireAuth = authenticate;\n\n// Optional authentication (for public endpoints that can benefit from user context)\nexport async function optionalAuth(c: Context, next: () => Promise) {\n try {\n const authHeader = c.req.header('Authorization');\n const token = extractToken(authHeader);\n \n if (token) {\n const decodedToken = await verifyFirebaseToken(token);\n const userData = await getUserData(decodedToken.uid);\n \n if (userData) {\n c.user = userData;\n logger.debug('Optional authentication successful', { userId: userData.uid });\n }\n }\n } catch (error) {\n // Silently fail for optional auth\n logger.debug('Optional authentication failed', { error: error.message });\n }\n \n await next();\n}\n\n// Rate limiting middleware (simple implementation)\nconst rateLimitMap = new Map();\n\nexport function rateLimit(maxRequests: number = 100, windowMs: number = 15 * 60 * 1000) {\n return async (c: Context, next: () => Promise) => {\n const ip = c.req.header('x-forwarded-for') || c.req.header('x-real-ip') || 'unknown';\n const now = Date.now();\n \n // Clean up expired entries\n for (const [key, value] of rateLimitMap.entries()) {\n if (now > value.resetTime) {\n rateLimitMap.delete(key);\n }\n }\n \n const current = rateLimitMap.get(ip);\n \n if (!current) {\n rateLimitMap.set(ip, { count: 1, resetTime: now + windowMs });\n } else if (now > current.resetTime) {\n rateLimitMap.set(ip, { count: 1, resetTime: now + windowMs });\n } else if (current.count >= maxRequests) {\n logger.security('Rate limit exceeded', { \n ip,\n count: current.count,\n maxRequests,\n path: c.req.path \n });\n \n return c.json({ \n success: false, \n error: 'Too many requests' \n }, 429);\n } else {\n current.count++;\n }\n \n await next();\n };\n}\n\n// CORS middleware (though Val Town handles this automatically)\nexport async function cors(c: Context, next: () => Promise) {\n await next();\n \n // Set CORS headers\n c.header('Access-Control-Allow-Origin', '*');\n c.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');\n c.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');\n c.header('Access-Control-Max-Age', '86400');\n}\n\n// Security headers middleware\nexport async function securityHeaders(c: Context, next: () => Promise) {\n await next();\n \n // Set security headers\n c.header('X-Content-Type-Options', 'nosniff');\n c.header('X-Frame-Options', 'DENY');\n c.header('X-XSS-Protection', '1; mode=block');\n c.header('Referrer-Policy', 'strict-origin-when-cross-origin');\n c.header('Content-Security-Policy', \"default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.twind.style https://esm.sh; style-src 'self' 'unsafe-inline' https://cdn.twind.style;\");\n}\n\n// Request validation middleware\nexport function validateRequest(schema: any) {\n return async (c: Context, next: () => Promise) => {\n try {\n const body = await c.req.json();\n \n // Simple validation (in production, use a proper validation library like Zod)\n if (!body || typeof body !== 'object') {\n return c.json({ \n success: false, \n error: 'Invalid request body' \n }, 400);\n }\n \n // Add validated body to context\n c.req.validatedBody = body;\n \n await next();\n } catch (error) {\n logger.warn('Request validation failed', { \n error: error.message,\n path: c.req.path \n });\n \n return c.json({ \n success: false, \n error: 'Invalid JSON in request body' \n }, 400);\n }\n };\n}\n\n// Audit logging middleware\nexport function auditLog(action: string, resource: string) {\n return async (c: Context, next: () => Promise) => {\n const startTime = Date.now();\n const ip = c.req.header('x-forwarded-for') || c.req.header('x-real-ip') || 'unknown';\n const userAgent = c.req.header('user-agent') || 'unknown';\n \n try {\n await next();\n \n const duration = Date.now() - startTime;\n \n if (c.user) {\n logger.audit(\n action,\n resource,\n c.user.uid,\n { \n method: c.req.method,\n path: c.req.path,\n duration,\n success: true \n },\n ip,\n userAgent\n );\n }\n } catch (error) {\n const duration = Date.now() - startTime;\n \n if (c.user) {\n logger.audit(\n action,\n resource,\n c.user.uid,\n { \n method: c.req.method,\n path: c.req.path,\n duration,\n success: false,\n error: error.message \n },\n ip,\n userAgent\n );\n }\n \n throw error;\n }\n };\n}","deleted","label",[170,171,153],"backend","middleware","permalink","https://www.val.town/x/rohitr21/untitled-4063/code/backend/middleware/auth.ts","extension","actionData","errors"]