Interface AuthAdapter

src/server/web/auth/adapter.ts:33–52

/** Auth adapter — pluggable authentication strategy. */
export interface AuthAdapter {
  /**
   * Authenticate an IncomingMessage (HTTP or WebSocket upgrade).
   * Returns null when the request is unauthenticated.
   */
  authenticate(req: IncomingMessage): AuthUser | null;

  /**
   * Register login/callback/logout routes on the Express app.
   * Called once during server startup before any requests arrive.
   */
  setupRoutes(app: Application): void;

  /**
   * Express middleware that rejects unauthenticated requests.
   * For browser clients it redirects to /auth/login; for API clients it
   * returns 401 JSON.
   */
  requireAuth(req: Request, res: Response, next: NextFunction): void;
}

// ── Cookie helpers ──────────────────────────────────────────────────────────