chore: perauset customer project

packages/functions/src/middleware.ts

@@ -0,0 +1,47 @@
+import { authBearer, cors } from '@pikku/core/middleware'
+import { addHTTPMiddleware } from '@pikku/core/http'
+import { betterAuthSession } from '@pikku/better-auth'
+
+const mapSession = (result: any) => ({
+  userId: result.user.id,
+  // A missing/malformed memberRoles field means the auth wiring/schema is
+  // stale — fail loudly instead of silently dropping to [] (no permissions),
+  // which shows the real roles in the UI while every gated RPC 403s.
+  memberRoles: (() => {
+    const raw = result.user.memberRoles
+    if (raw == null) {
+      throw new Error(
+        `Session for user ${result.user.id} has no memberRoles — auth wiring/schema is out of date`,
+      )
+    }
+    // The SQLite kysely runs SerializePlugin, so the JSON `member_roles`
+    // column may already be deserialized to an array; only parse a string.
+    return (Array.isArray(raw) ? raw : JSON.parse(raw)) as string[]
+  })(),
+})
+
+addHTTPMiddleware('*', [
+  cors({ origin: true, credentials: true }),
+  betterAuthSession({
+    mapSession,
+    impersonation: {
+      loadUser: (userId: string, services: any) =>
+        services.kysely
+          .selectFrom('user')
+          .where('id', '=', userId)
+          .select(['id', 'memberRoles'])
+          .executeTakeFirst(),
+    },
+  }),
+  // External consoles (sandbox/woven-build view) can't carry the session cookie,
+  // so they authenticate with `Authorization: Bearer <PIKKU_CONSOLE_TOKEN>`. The
+  // CLI normally emits this alongside its session middleware, but our own global
+  // session middleware makes it step aside (pikku#754) — so add the console-token
+  // bridge here or console:* RPCs 403 in the sandbox.
+  authBearer({
+    token: {
+      secretId: 'PIKKU_CONSOLE_TOKEN',
+      userSession: { userId: 'pikku-console-token' },
+    },
+  }),
+])