Function authMiddleware

server/middleware/auth.ts:59–106

(c: Context, next: Next)

 * Caches verified user identity for 30s to reduce round-trips.
 */
export async function authMiddleware(c: Context, next: Next): Promise<Response | void> {
  const authHeader = c.req.header('Authorization');

  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    return c.json({ error: 'Missing or invalid Authorization header' }, 401);
  }

  const token = authHeader.slice(7);

  let userId: string;
  let userEmail: string;

  // Check if this token was recently verified
  const cached = verifiedUserCache.get(token);
  if (cached && Date.now() - cached.verifiedAt < VERIFY_TTL) {
    userId = cached.id;
    userEmail = cached.email;
  } else {
    // Verify JWT signature + expiry via Supabase
    try {
      const { data: { user }, error } = await supabase.auth.getUser(token);
      if (error || !user) {
        return c.json({ error: 'Invalid or expired token' }, 401);
      }
      userId = user.id;
      userEmail = user.email ?? '';
      verifiedUserCache.set(token, { id: userId, email: userEmail, verifiedAt: Date.now() });
    } catch (err) {
      console.error('[auth] Supabase verification failed:', err instanceof Error ? err.message : err);
      return c.json({ error: 'Authentication service unavailable' }, 503);
    }
  }

  // Cached profile lookup
  const profile = await getProfile(userId);

  const authUser: AuthUser = {
    id: userId,
    email: userEmail,
    role: (profile?.role as 'user' | 'admin') ?? 'user',
    displayName: profile?.display_name ?? '',
    avatarUrl: profile?.avatar_url ?? '',
  };

  c.set('user', authUser);
  c.set('userId', userId);
  await next();
}

/**
 * Requires the authenticated user to have admin role.