feat: widgets and ai chat

apps/api/src/middlewares/org-admin-or-automation-key.ts

@@ -2,7 +2,7 @@ import { Context, Next } from 'hono';
 import type { TOrganizationApiKeyScope } from '@cio/utils/validation/organization';
 
 import { ErrorCodes } from '@api/utils/errors';
-import { isUserOrgAdmin } from '@cio/db/queries/organization';
+import { ROLE } from '@cio/utils/constants';
 import { organizationApiKeyHasScopes } from '@api/services/organization/automation-key';
 
 export const orgAdminOrAutomationKeyMiddleware =
@@ -55,8 +55,8 @@ export const orgAdminOrAutomationKeyMiddleware =
         );
       }
 
-      const isAdmin = await isUserOrgAdmin(orgId, user.id);
-      if (!isAdmin) {
+      const orgRoles = (c.get('orgRoles') as Record<string, number> | undefined) ?? {};
+      if (orgRoles[orgId] !== ROLE.ADMIN) {
         return c.json(
           {
             success: false,

apps/api/src/middlewares/org-admin.ts

@@ -1,12 +1,15 @@
 import { Context, Next } from 'hono';
 
 import { ErrorCodes } from '@api/utils/errors';
-import { isUserOrgAdmin } from '@cio/db/queries/organization';
+import { ROLE } from '@cio/utils/constants';
 
 /**
- * Middleware to check if the authenticated user is an admin of the organization
- * Requires authMiddleware to be applied first
- * Expects orgId in the 'cio-org-id' header
+ * Middleware to check if the authenticated user is an admin of the organization.
+ * Reads the role from the Better Auth session (populated by the customSession plugin),
+ * so no per-request DB query is performed.
+ *
+ * Requires authMiddleware to be applied first.
+ * Expects orgId in the 'cio-org-id' header.
  */
 export const orgAdminMiddleware = async (c: Context, next: Next) => {
   try {
@@ -23,7 +26,6 @@ export const orgAdminMiddleware = async (c: Context, next: Next) => {
     }
 
     const orgId = c.req.header('cio-org-id');
-
     if (!orgId) {
       return c.json(
         {
@@ -35,8 +37,10 @@ export const orgAdminMiddleware = async (c: Context, next: Next) => {
       );
     }
 
-    const isAdmin = await isUserOrgAdmin(orgId, user.id);
-    if (!isAdmin) {
+    const orgRoles = (c.get('orgRoles') as Record<string, number> | undefined) ?? {};
+    const roleId = orgRoles[orgId];
+
+    if (roleId !== ROLE.ADMIN) {
       return c.json(
         {
           success: false,

apps/api/src/middlewares/org-member.ts

@@ -1,12 +1,13 @@
 import { Context, Next } from 'hono';
 
-import { getUserOrgRole } from '@cio/db/queries/organization';
-
 /**
- * Middleware to check if the authenticated user is a member of the organization
- * Requires authMiddleware to be applied first
- * Expects orgId in the 'cio-org-id' header
- * Stores orgRole and orgId in context for use in route handlers
+ * Middleware to check if the authenticated user is a member of the organization.
+ * Reads the role from the Better Auth session (populated by the customSession plugin),
+ * so no per-request DB query is performed.
+ *
+ * Requires authMiddleware to be applied first.
+ * Expects orgId in the 'cio-org-id' header.
+ * Stores orgRole and orgId in context for use in route handlers.
  */
 export const orgMemberMiddleware = async (c: Context, next: Next) => {
   try {
@@ -34,8 +35,10 @@ export const orgMemberMiddleware = async (c: Context, next: Next) => {
       );
     }
 
-    const roleId = await getUserOrgRole(orgId, user.id);
-    if (roleId === null) {
+    const orgRoles = (c.get('orgRoles') as Record<string, number> | undefined) ?? {};
+    const roleId = orgRoles[orgId];
+
+    if (roleId === undefined) {
       return c.json(
         {
           success: false,
@@ -46,7 +49,6 @@ export const orgMemberMiddleware = async (c: Context, next: Next) => {
       );
     }
 
-    // Store orgRole and orgId in context for use in route handlers
     c.set('userRole', roleId);
     c.set('orgId', orgId);
 

apps/api/src/middlewares/org-team-member.ts

@@ -1,12 +1,15 @@
 import { Context, Next } from 'hono';
 
 import { ErrorCodes } from '@api/utils/errors';
-import { isUserOrgTeamMember } from '@cio/db/queries/organization';
+import { ROLE } from '@cio/utils/constants';
 
 /**
- * Middleware to check if the authenticated user is a team member (ADMIN or TUTOR) of the organization
- * Requires authMiddleware to be applied first
- * Expects orgId in the 'cio-org-id' header
+ * Middleware to check if the authenticated user is a team member (ADMIN or TUTOR) of the organization.
+ * Reads the role from the Better Auth session (populated by the customSession plugin),
+ * so no per-request DB query is performed.
+ *
+ * Requires authMiddleware to be applied first.
+ * Expects orgId in the 'cio-org-id' header.
  */
 export const orgTeamMemberMiddleware = async (c: Context, next: Next) => {
   try {
@@ -35,8 +38,10 @@ export const orgTeamMemberMiddleware = async (c: Context, next: Next) => {
       );
     }
 
-    const isTeamMember = await isUserOrgTeamMember(orgId, user.id);
-    if (!isTeamMember) {
+    const orgRoles = (c.get('orgRoles') as Record<string, number> | undefined) ?? {};
+    const roleId = orgRoles[orgId];
+
+    if (roleId !== ROLE.ADMIN && roleId !== ROLE.TUTOR) {
       return c.json(
         {
           success: false,