61 lines
2.3 KiB
TypeScript
61 lines
2.3 KiB
TypeScript
export default defineNuxtRouteMiddleware(async (to) => {
|
|
// Skip on server-side rendering
|
|
if (import.meta.server) return;
|
|
|
|
// Skip if no auth requirements or roles specified
|
|
if (!to.meta.roles) {
|
|
return;
|
|
}
|
|
|
|
console.log('[AUTHORIZATION] Checking route access for:', to.path, 'Required roles:', to.meta.roles);
|
|
|
|
try {
|
|
// Get auth state from authentication middleware (already cached)
|
|
const nuxtApp = useNuxtApp();
|
|
const authState = nuxtApp.payload?.data?.authState;
|
|
|
|
// If auth state not available, authentication middleware hasn't run or failed
|
|
if (!authState || !authState.authenticated || !authState.user) {
|
|
console.log('[AUTHORIZATION] No auth state found from authentication middleware');
|
|
|
|
// Try to get from session cache as fallback
|
|
const sessionCache = nuxtApp.payload?.data?.['auth:session:cache'];
|
|
if (!sessionCache || !sessionCache.authenticated) {
|
|
console.log('[AUTHORIZATION] User not authenticated, redirecting to login');
|
|
return navigateTo('/login');
|
|
}
|
|
|
|
// Use cached session
|
|
authState.user = sessionCache.user;
|
|
authState.groups = sessionCache.groups || [];
|
|
}
|
|
|
|
// Get required roles for this route
|
|
const requiredRoles = Array.isArray(to.meta.roles) ? to.meta.roles : [to.meta.roles];
|
|
const userGroups = authState.groups || [];
|
|
|
|
// Check if user has any of the required roles
|
|
const hasRequiredRole = requiredRoles.some(role => userGroups.includes(role));
|
|
|
|
if (!hasRequiredRole) {
|
|
console.log('[AUTHORIZATION] Access denied. User groups:', userGroups, 'Required roles:', requiredRoles);
|
|
|
|
// Store the error in nuxtApp to show toast on redirect
|
|
nuxtApp.payload.authError = `Access denied. This page requires one of the following roles: ${requiredRoles.join(', ')}`;
|
|
|
|
// Redirect to dashboard instead of login since user is authenticated
|
|
return navigateTo('/dashboard');
|
|
}
|
|
|
|
console.log('[AUTHORIZATION] Access granted for route:', to.path);
|
|
} catch (error) {
|
|
console.error('[AUTHORIZATION] Error checking route access:', error);
|
|
|
|
// Don't automatically redirect to login on errors
|
|
// Let the authentication middleware handle auth failures
|
|
const toast = useToast();
|
|
toast.error('Failed to verify permissions. Please try again.');
|
|
return navigateTo('/dashboard');
|
|
}
|
|
});
|