fix: protect admin routes (#1941)

Author: HugoRCD

server/api/auth/github.get.ts

@@ -1,28 +1,8 @@
-interface TeamMember {
-  login: string
-}
-
-const getCoreMembers = cachedFunction(async () => {
-  return await $fetch<TeamMember[]>('https://api.nuxt.com/teams/core')
-}, {
-  maxAge: 60 * 60, // 1 hour
-  getKey: () => 'core-members'
-})
-
 export default defineOAuthGitHubEventHandler({
   async onSuccess(event, { user }) {
-    const coreMembers = await getCoreMembers()
-    if (!coreMembers) {
-      throw createError({
-        statusCode: 500,
-        statusMessage: 'Failed to fetch core team members.'
-      })
-    }
-
-    const userLogin = user.login.toLowerCase()
-    const coreTeamHasUser = coreMembers.some(member => member.login.toLowerCase() === userLogin)
+    const adminMember = await isCoreTeamMember(user.login.toLowerCase())
 
-    if (!coreTeamHasUser) {
+    if (!adminMember) {
       return sendRedirect(event, '/admin/login?error=access-denied')
     }
 

server/api/feedback/[id].delete.ts

@@ -6,6 +6,8 @@ const deleteParamsSchema = z.object({
 })
 
 export default defineEventHandler(async (event) => {
+  await requireUserSession(event)
+
   const { id } = await getValidatedRouterParams(event, deleteParamsSchema.parse)
 
   const drizzle = useDrizzle()

server/api/feedback/index.get.ts

@@ -1,4 +1,6 @@
-export default defineEventHandler(async () => {
+export default defineEventHandler(async (event) => {
+  await requireUserSession(event)
+
   const drizzle = useDrizzle()
 
   return await drizzle.query.feedback.findMany()

server/utils/team.ts

@@ -0,0 +1,19 @@
+export const getCoreMembers = cachedFunction(async () => {
+  return await $fetch<{
+    login: string
+  }[]>('https://api.nuxt.com/teams/core')
+}, {
+  maxAge: 60 * 60, // 1 hour
+  getKey: () => 'core-members'
+})
+
+export async function isCoreTeamMember(login: string) {
+  const coreMembers = await getCoreMembers()
+  if (!coreMembers) {
+    throw createError({
+      statusCode: 500,
+      statusMessage: 'Failed to fetch core team members.'
+    })
+  }
+  return coreMembers.some(member => member.login.toLowerCase() === login)
+}