Rotimi Best
ac4fdf1dd3
- Create secure server-side API endpoints for course data, marks, exercises, newsfeeds, submissions, and organization management - Implement role-based permission checking using checkUserCoursePermissions utility - Move all client-side Supabase calls to authenticated server endpoints in /api/courses/ and /api/org/ - Add proper authentication and authorization middleware via hooks.server.ts - Update service functions to use getAccessToken() for API authentication - Ensure data filtering based on user roles (students only see their own data) - Maintain backward compatibility with existing component interfaces
53 lines
1.3 KiB
TypeScript
53 lines
1.3 KiB
TypeScript
import { getSessionData } from '$lib/utils/services/auth/session';
|
|
import { type Handle, redirect } from '@sveltejs/kit';
|
|
import { isPublicApiRoute, isPublicRoute } from '$lib/utils/functions/routes/isPublicRoute';
|
|
import { ROUTE } from '$lib/utils/constants/routes';
|
|
|
|
export const handle: Handle = async (args) => {
|
|
const { event } = args;
|
|
const sessionData = await getSessionData(event.cookies);
|
|
|
|
if (sessionData) {
|
|
event.locals = sessionData;
|
|
}
|
|
|
|
// Handle API routes
|
|
if (event.url.pathname.includes('/api')) {
|
|
return handleAPIRoutes(args);
|
|
}
|
|
|
|
// Handle other routes (ui pages, etc.)
|
|
return handlePagesRoutes(args);
|
|
};
|
|
|
|
const handlePagesRoutes: Handle = async ({ event, resolve }) => {
|
|
const { pathname } = event.url;
|
|
|
|
if (isPublicRoute(pathname)) {
|
|
return resolve(event);
|
|
}
|
|
|
|
if (!event.locals.user) {
|
|
const shouldAddRedirectParam = !pathname.includes(ROUTE.LOGOUT);
|
|
const redirectPath = shouldAddRedirectParam ? `${ROUTE.LOGIN}?redirect=${pathname}` : ROUTE.LOGIN;
|
|
|
|
return redirect(303, redirectPath);
|
|
}
|
|
|
|
return resolve(event);
|
|
};
|
|
|
|
const handleAPIRoutes: Handle = async ({ event, resolve }) => {
|
|
const { pathname } = event.url;
|
|
|
|
if (isPublicApiRoute(pathname)) {
|
|
return resolve(event);
|
|
}
|
|
|
|
if (!event.locals.user) {
|
|
redirect(303, '/login');
|
|
}
|
|
|
|
return resolve(event);
|
|
};
|