Function enforceAuthRequirement

worker/middleware/auth/routeAuth.ts:159–229

(c: Context<AppEnv>)

 * Enforce authentication requirement
 */
export async function enforceAuthRequirement(c: Context<AppEnv>) : Promise<Response | undefined> {
    let user: AuthUser | null = c.get('user') || null;

    const requirement = c.get('authLevel') as AuthRequirement | undefined;
    const authOptions = c.get('authLevelOptions') as AuthLevelOptions | undefined;
    
    if (!requirement) {
        logger.error('No authentication level found');
        return errorResponse('No authentication level found', 500);
    }
    
    // Only perform auth if we need it or don't have user yet
    if (!user && (requirement.level === 'authenticated' || requirement.level === 'owner-only')) {
        const request = c.req.raw;
        const env = c.env;
        const params = c.req.param();
        
        // Strategy 1: Ticket-based auth (if configured and ticket present)
        if (authOptions?.ticketAuth && hasTicketParam(request)) {
            const ticketAuth = await authenticateViaTicket(request, env, authOptions.ticketAuth, params);
            if (ticketAuth) {
                user = ticketAuth.user;
                c.set('user', user);
                c.set('sessionId', ticketAuth.sessionId);
                Sentry.setUser({ id: user.id, email: user.email });
                
                const config = await getUserConfigurableSettings(c.env, user.id);
                c.set('config', config);
                
                // Skip rate limiting for ticket auth (already rate-limited at ticket creation)
                logger.info('Authenticated via ticket', { userId: user.id, resourceType: authOptions.ticketAuth.resourceType });
            } else {
                // Ticket was provided but invalid - reject immediately
                return errorResponse('Invalid or expired ticket', 403);
            }
        }
        
        // Strategy 2: Standard JWT auth (header/cookie)
        if (!user) {
            const userSession = await authMiddleware(c.req.raw, c.env);
            if (!userSession) {
                return errorResponse('Authentication required', 401);
            }
            user = userSession.user;
            c.set('user', user);
            c.set('sessionId', userSession.sessionId);
            Sentry.setUser({ id: user.id, email: user.email });

            const config = await getUserConfigurableSettings(c.env, user.id);
            c.set('config', config);

            try {
                await RateLimitService.enforceAuthRateLimit(c.env, config.security.rateLimit, user, c.req.raw);
            } catch (error) {
                if (error instanceof RateLimitExceededError) {
                    return errorResponse(error, 429);
                }
                logger.error('Error enforcing auth rate limit', error);