james
0ceb4a2b25
Wave 2 of replacing the fixed-data mock adapter: the auth domain joins the live list, so credentials, roles and tokens belong to the real user. - session: validate a restored token through /auth/me instead of trusting localStorage, clearing it on 401/403 but keeping it when the API is merely unreachable; the route guard now uses the validated session - login: report a 401 as invalid credentials rather than a generic failure, and drop the 6-character client rule so the API owns the password policy - register: raise the rule to the API's 8 characters, remove the verification-code field (its button only counted down and the value was never sent), and report a duplicate email (409) distinctly - TopBar and the user profile render their session-dependent branch client-only: validating the session before hydration made those localStorage-backed branches report hydration mismatches the previous code did not Verified against the running backend: wrong password rejected, real JWT issued, /user reachable, a short password refused with no network call, duplicate email reported, a tampered token cleared and bounced to sign-in, a stale token kept when the API is down, and the fixed-data rollback still signs in with the backend stopped. Also re-cuts docs/TBD-migrate-wave.md: auth is done, and cart, orders, shipments and invoices must move together, because the mock adapter keeps their state in one shared object and a partial flip fails at checkout. OpenSpec change: openspec/changes/replace-mock-api-wave-2
11 lines
491 B
TypeScript
11 lines
491 B
TypeScript
export default defineNuxtRouteMiddleware(async () => {
|
|
if (import.meta.server) return;
|
|
const session = useSessionStore();
|
|
if (!session.token) session.hydrate();
|
|
if (!session.token) return navigateTo("/login");
|
|
// Trust the auth API's answer rather than whatever localStorage claims; a
|
|
// rejected token clears the session inside validate().
|
|
if (!(await session.validate())) return navigateTo("/login");
|
|
if (session.user?.role !== "customer") return navigateTo("/login");
|
|
});
|