alexei.dolgolyov
215c8fdd46
- Add apiTokenScope to App.Locals type definition - Store token scope in event.locals during API token auth - Block write operations (POST/PATCH/PUT/DELETE) for read-scoped tokens - Block admin paths for non-admin-scoped tokens - Returns 403 with descriptive error message
35 lines
619 B
TypeScript
35 lines
619 B
TypeScript
// See https://svelte.dev/docs/kit/types#app.d.ts
|
|
|
|
declare global {
|
|
namespace App {
|
|
interface Error {
|
|
message: string;
|
|
code?: string;
|
|
}
|
|
|
|
interface Locals {
|
|
user: {
|
|
id: string;
|
|
email: string;
|
|
displayName: string;
|
|
role: 'admin' | 'user';
|
|
} | null;
|
|
session: {
|
|
id: string;
|
|
expiresAt: Date;
|
|
} | null;
|
|
/** API token scope — set when auth is via Bearer token, null for JWT sessions */
|
|
apiTokenScope: 'read' | 'write' | 'admin' | null;
|
|
}
|
|
|
|
interface PageData {
|
|
user: App.Locals['user'];
|
|
}
|
|
|
|
// interface PageState {}
|
|
// interface Platform {}
|
|
}
|
|
}
|
|
|
|
export {};
|