vegard
6bc742cc8d
Implementerer autentisering med Authentik via @auth/sveltekit:
- OIDC authorization code flow med PKCE og state-verifisering
- JWT-callback lagrer authentik_sub (SHA256-hash, ikke UUID) for
konsistens med maskinrommets auth_identities-tabell
- Server hooks: alle ruter unntatt /signin og /auth/* krever sesjon
- Uautentiserte brukere redirectes til /signin (303)
- Innloggingsside med client-side signIn('authentik')
- Hovedside viser innlogget bruker med logg ut-knapp
- TypeScript-typer utvidet med JWT.authentik_sub
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
23 lines
747 B
TypeScript
23 lines
747 B
TypeScript
import { redirect, type Handle } from '@sveltejs/kit';
|
|
import { handle as authHandle } from './auth';
|
|
import { sequence } from '@sveltejs/kit/hooks';
|
|
|
|
/** Protect all routes except /signin and /auth/* (OIDC callback paths). */
|
|
const authorizationHandle: Handle = async ({ event, resolve }) => {
|
|
const path = event.url.pathname;
|
|
|
|
// Allow auth-related routes through without session check
|
|
if (path.startsWith('/auth/') || path === '/signin') {
|
|
return resolve(event);
|
|
}
|
|
|
|
const session = await event.locals.auth();
|
|
if (!session?.user) {
|
|
throw redirect(303, '/signin');
|
|
}
|
|
|
|
return resolve(event);
|
|
};
|
|
|
|
// Authentication first (sets up locals.auth), then authorization
|
|
export const handle: Handle = sequence(authHandle, authorizationHandle);
|