abadd469bc
New routes: companies, approvals, costs, dashboard, authz. New services: companies, approvals, costs, dashboard, heartbeat, activity-log. Add auth middleware and structured error handling. Expand existing agent and issue routes with richer CRUD operations. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
31 lines
778 B
TypeScript
31 lines
778 B
TypeScript
import type { Request } from "express";
|
|
import { forbidden } from "../errors.js";
|
|
|
|
export function assertBoard(req: Request) {
|
|
if (req.actor.type !== "board") {
|
|
throw forbidden("Board access required");
|
|
}
|
|
}
|
|
|
|
export function assertCompanyAccess(req: Request, companyId: string) {
|
|
if (req.actor.type === "agent" && req.actor.companyId !== companyId) {
|
|
throw forbidden("Agent key cannot access another company");
|
|
}
|
|
}
|
|
|
|
export function getActorInfo(req: Request) {
|
|
if (req.actor.type === "agent") {
|
|
return {
|
|
actorType: "agent" as const,
|
|
actorId: req.actor.agentId ?? "unknown-agent",
|
|
agentId: req.actor.agentId ?? null,
|
|
};
|
|
}
|
|
|
|
return {
|
|
actorType: "user" as const,
|
|
actorId: req.actor.userId ?? "board",
|
|
agentId: null,
|
|
};
|
|
}
|