{"file":"auth-Cq1Vc_k9.js","mappings":";;;;;;;;;;;;;;;;;;AAEE,MAAA,iCAA0B,OAAA,IAAA,SAAA;AAAA,MAAA,QAAA;AACxB,MAAA,GAAA,SAAA,UAAA;AACF;AAAA,EAGA;AACA,sBAAiB,UAAO,cAAA;AACtB,MAAA,CAAA,mBAAkB;AACpB,WAAA,WAAA,QAAA;AAAA,EAGA;AAGA,oBAAe,aAAM;AACnB,MAAA,CAAA,UAAI,MAAA;AACF,QAAA;AACF;AAAA,MAAA,CAAA,QAAQ,SAAA,IAAAA,aAAA,MAAA,UAAA,UAAA,CAAA,GAAA,MAAA,QAAA,UAAA;AAAA;AAAA,IAEN,QAAA;AACA;AACF,aAAA,WAAA,QAAA;AAAA,IACF;AAAA,EAGA;AACE,MAAA,CAAA,UAAU,MAAO;AACjB;AACF,WAAA,WAAA,QAAA;AAAA,EAGA;AACA,QAAM,eAAY,CAAA,cAAe,SAAY,aAAY,aAAA,aAAA;AAEzD,QAAK,YAAa,UAAS,KAAA,QAAW,IAAA,YAAA;AAEpC,MAAA,CAAA,aAAU,SAAO,QAAA,GAAA;AACjB;AACF,WAAA,WAAA,QAAA;AAAA,EACF;;","names":["__executeAsync"],"sources":["../../../../middleware/auth.ts"],"sourcesContent":["export default defineNuxtRouteMiddleware(async (to, from) => {\n  // Skip auth check on the login page itself\n  if (to.path === '/login') {\n    return\n  }\n\n  // Check for the access_token cookie\n  const tokenCookie = useCookie('access_token')\n  if (!tokenCookie.value) {\n    return navigateTo('/login')\n  }\n\n  // ── RBAC: Verify user role from Pinia authStore ──────────────────────\n  const authStore = useAuthStore()\n\n  // If the user profile hasn't been loaded yet, try to fetch it\n  if (!authStore.user) {\n    try {\n      await authStore.fetchUser()\n    } catch {\n      // Token is invalid or expired — clear and redirect to login\n      authStore.logout()\n      return navigateTo('/login')\n    }\n  }\n\n  // After fetch, check if user is still null (fetch failed silently)\n  if (!authStore.user) {\n    authStore.logout()\n    return navigateTo('/login')\n  }\n\n  // Allowed staff roles that can access the admin panel\n  const allowedRoles = ['SUPERADMIN', 'ADMIN', 'MODERATOR', 'SALES_REP', 'SERVICE_MGR']\n  const userRole = (authStore.user.role || '').toUpperCase()\n\n  if (!allowedRoles.includes(userRole)) {\n    // Standard USER or unknown role — kick them out, clear token, redirect\n    authStore.logout()\n    return navigateTo('/login')\n  }\n})\n"],"version":3}