elegalsoftware/apps/api/src/auth/plugin.ts

import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';
import fp from 'fastify-plugin';
import { SESSION_COOKIE, loadSession } from './sessions';
import { isProd, env } from '../env';
import { ensureSuperadminFlag } from './superadmin';

export type FirmRole = 'owner' | 'attorney' | 'paralegal' | 'staff';

declare module 'fastify' {
  interface FastifyRequest {
    user?: {
      id: string;
      email: string;
      firmId: string | null;
      role: string;
      isSuperadmin: boolean;
      isSuspended: boolean;
      emailVerified: boolean;
      /** Superadmin id when this session was opened via admin impersonation, else null. */
      impersonatedBy: string | null;
    };
  }
  interface FastifyInstance {
    requireAuth: (req: FastifyRequest, reply: FastifyReply) => Promise<void>;
    requireFirm: (req: FastifyRequest, reply: FastifyReply) => Promise<void>;
    requireSuperadmin: (req: FastifyRequest, reply: FastifyReply) => Promise<void>;
    requireRole: (
      ...roles: FirmRole[]
    ) => (req: FastifyRequest, reply: FastifyReply) => Promise<void>;
    setSessionCookie: (reply: FastifyReply, token: string, expiresAt: Date) => void;
    clearSessionCookie: (reply: FastifyReply) => void;
  }
}

async function plugin(app: FastifyInstance) {
  app.addHook('onRequest', async (req) => {
    const token = req.cookies?.[SESSION_COOKIE];
    if (!token) return;

    const session = await loadSession(token);
    if (!session) return;

    // Auto-promote/demote based on SUPERADMIN_EMAILS env var, every request — cheap and self-healing.
    const isSuperadmin = await ensureSuperadminFlag(
      session.user.id,
      session.user.email,
      session.user.isSuperadmin,
      session.user.emailVerifiedAt,
    );

    req.user = {
      id: session.user.id,
      email: session.user.email,
      firmId: session.user.firmId,
      role: session.user.role,
      isSuperadmin,
      isSuspended: session.user.isSuspended,
      emailVerified: Boolean(session.user.emailVerifiedAt),
      impersonatedBy: session.session.impersonatedBy,
    };
  });

  app.decorate('requireAuth', async (req: FastifyRequest, reply: FastifyReply) => {
    if (!req.user) return reply.code(401).send({ error: 'unauthorized' });
    if (req.user.isSuspended) return reply.code(403).send({ error: 'account_suspended' });
  });

  app.decorate('requireFirm', async (req: FastifyRequest, reply: FastifyReply) => {
    if (!req.user) return reply.code(401).send({ error: 'unauthorized' });
    if (req.user.isSuspended) return reply.code(403).send({ error: 'account_suspended' });
    if (!req.user.firmId) return reply.code(403).send({ error: 'no_firm' });
  });

  app.decorate('requireSuperadmin', async (req: FastifyRequest, reply: FastifyReply) => {
    if (!req.user) return reply.code(401).send({ error: 'unauthorized' });
    if (req.user.isSuspended) return reply.code(403).send({ error: 'account_suspended' });
    if (!req.user.isSuperadmin) return reply.code(403).send({ error: 'forbidden' });
    // A superadmin who impersonated their way into a firm must not be able to steer the
    // platform-wide admin surface from inside that borrowed session.
    if (req.user.impersonatedBy) return reply.code(403).send({ error: 'forbidden_while_impersonating' });
  });

  // Role gate for firm-scoped routes that only some members of a firm should reach (billing,
  // full-firm export, account deletion). Compose AFTER requireFirm — it assumes req.user is set
  // and firmId is present. Superadmins pass, unless they're inside an impersonated session, in
  // which case they get exactly the target user's real authority and nothing more.
  app.decorate(
    'requireRole',
    (...roles: FirmRole[]) =>
      async (req: FastifyRequest, reply: FastifyReply) => {
        if (!req.user) return reply.code(401).send({ error: 'unauthorized' });
        if (req.user.isSuspended) return reply.code(403).send({ error: 'account_suspended' });
        if (req.user.isSuperadmin && !req.user.impersonatedBy) return;
        if (!roles.includes(req.user.role as FirmRole)) {
          return reply.code(403).send({ error: 'insufficient_role', required: roles });
        }
      },
  );

  app.decorate('setSessionCookie', (reply: FastifyReply, token: string, expiresAt: Date) => {
    reply.setCookie(SESSION_COOKIE, token, {
      path: '/',
      httpOnly: true,
      secure: isProd,
      sameSite: 'lax',
      domain: env.COOKIE_DOMAIN || undefined,
      expires: expiresAt,
      signed: false,
    });
  });

  app.decorate('clearSessionCookie', (reply: FastifyReply) => {
    reply.clearCookie(SESSION_COOKIE, {
      path: '/',
      httpOnly: true,
      secure: isProd,
      sameSite: 'lax',
      domain: env.COOKIE_DOMAIN || undefined,
    });
  });
}

export const authPlugin = fp(plugin, { name: 'auth' });