All files / src/lib/api/middleware withUser.ts

100% Statements 61/61
94.73% Branches 18/19
100% Functions 1/1
100% Lines 61/61

Press n or j to go to the next uncovered block, b, p or k for the previous block.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 621x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 3x 3x 3x 3x 24x 24x 24x 24x 24x 24x 24x 5x 5x 19x 19x 19x 19x 24x 24x 24x 24x 24x 24x 19x 24x 3x 3x 16x 16x 3x 3x  
/**
 * User Middleware
 *
 * Extends auth middleware to include user data from the database.
 */
 
import { NextRequest, NextResponse } from 'next/server';
import { getServerSession } from '@/lib/auth';
import { prisma } from '@/lib/prisma';
import { unauthorizedResponse, notFoundResponse, type ApiErrorResponse } from '../responses';
import type {
  RouteContext,
  AuthenticatedUserHandler,
  AuthenticatedUser } from './types';
 
/**
 * User middleware
 *
 * Wraps a handler to require authentication AND fetch the user from the database.
 * Useful when you need the user's database ID or role.
 *
 * @example
 * ```ts
 * export const GET = withUser(async (request, context, session, user) => {
 *   // user is the database user record
 *   const orders = await prisma.order.findMany({ where: { userId: user.id } });
 *   return successResponse(orders);
 * });
 * ```
 */
export function withUser<T>(
  handler: AuthenticatedUserHandler<T>
) {
  return async (
    request: Request,
    context?: RouteContext
  ): Promise<NextResponse<T | ApiErrorResponse>> => {
    const session = await getServerSession();
 
    // Check for valid session with user id (numeric) or email
    if (!session?.user?.id && !session?.user?.email) {
      return unauthorizedResponse();
    }
 
    const user = await prisma.user.findUnique({
      where: session.user.email
        ? { email: session.user.email }
        : { id: session.user.id },
      select: {
        id: true,
        email: true,
        name: true,
        role: true } });
 
    if (!user) {
      return notFoundResponse('User');
    }
 
    return handler(request as NextRequest, context, session, user as AuthenticatedUser);
  };
}