admin felület fejlesztése garázs, előfizeztési csomagok

frontend_admin/middleware/auth.ts

@@ -1,4 +1,4 @@
-export default defineNuxtRouteMiddleware((to, from) => {
+export default defineNuxtRouteMiddleware(async (to, from) => {
   // Skip auth check on the login page itself
   if (to.path === '/login') {
     return
@@ -10,7 +10,33 @@ export default defineNuxtRouteMiddleware((to, from) => {
     return navigateTo('/login')
   }
 
-  // If the store is already initialized, check isAuthenticated
-  // Otherwise, the token cookie presence is sufficient for the guard
-  // The store's init() will validate the token on app mount
+  // ── RBAC: Verify user role from Pinia authStore ──────────────────────
+  const authStore = useAuthStore()
+
+  // If the user profile hasn't been loaded yet, try to fetch it
+  if (!authStore.user) {
+    try {
+      await authStore.fetchUser()
+    } catch {
+      // Token is invalid or expired — clear and redirect to login
+      authStore.logout()
+      return navigateTo('/login')
+    }
+  }
+
+  // After fetch, check if user is still null (fetch failed silently)
+  if (!authStore.user) {
+    authStore.logout()
+    return navigateTo('/login')
+  }
+
+  // Allowed staff roles that can access the admin panel
+  const allowedRoles = ['SUPERADMIN', 'ADMIN', 'MODERATOR', 'SALES_REP', 'SERVICE_MGR']
+  const userRole = (authStore.user.role || '').toUpperCase()
+
+  if (!allowedRoles.includes(userRole)) {
+    // Standard USER or unknown role — kick them out, clear token, redirect
+    authStore.logout()
+    return navigateTo('/login')
+  }
 })