43 lines
1.3 KiB
TypeScript
43 lines
1.3 KiB
TypeScript
export default defineNuxtRouteMiddleware(async (to, from) => {
|
|
// Skip auth check on the login page itself
|
|
if (to.path === '/login') {
|
|
return
|
|
}
|
|
|
|
// Check for the access_token cookie
|
|
const tokenCookie = useCookie('access_token')
|
|
if (!tokenCookie.value) {
|
|
return navigateTo('/login')
|
|
}
|
|
|
|
// ── RBAC: Verify user role from Pinia authStore ──────────────────────
|
|
const authStore = useAuthStore()
|
|
|
|
// If the user profile hasn't been loaded yet, try to fetch it
|
|
if (!authStore.user) {
|
|
try {
|
|
await authStore.fetchUser()
|
|
} catch {
|
|
// Token is invalid or expired — clear and redirect to login
|
|
authStore.logout()
|
|
return navigateTo('/login')
|
|
}
|
|
}
|
|
|
|
// After fetch, check if user is still null (fetch failed silently)
|
|
if (!authStore.user) {
|
|
authStore.logout()
|
|
return navigateTo('/login')
|
|
}
|
|
|
|
// Allowed staff roles that can access the admin panel
|
|
const allowedRoles = ['SUPERADMIN', 'ADMIN', 'MODERATOR', 'SALES_REP', 'SERVICE_MGR']
|
|
const userRole = (authStore.user.role || '').toUpperCase()
|
|
|
|
if (!allowedRoles.includes(userRole)) {
|
|
// Standard USER or unknown role — kick them out, clear token, redirect
|
|
authStore.logout()
|
|
return navigateTo('/login')
|
|
}
|
|
})
|