- Add role detection

- Restrict APIs to personnels
- Show 403 for unauthorized access"

defaults/interfaces.ts

@@ -4,6 +4,7 @@ import { AsyncRoute } from "$fresh/src/server/types.ts";
 interface AuthenticatedState {
   isAuthenticated: true;
   isFromPolytech: boolean;
+  role: "etudiants" | "personnels" | "autres";
   session: CasContent;
 }
 

routes/_middleware.ts

@@ -26,6 +26,14 @@ function isRoutePublic(route: string): boolean {
   );
 }
 
+/**
+ * Checks if the given route is an API route.
+ * @param route The route to check.
+ * @returns `true` if the route is an API route, `false` otherwise.
+ */
+function isRouteAnAPI(route: string): boolean {
+  return route.includes("/api/");
+}
 /**
  * Get the given user's key, creating it if not already existing.
  * @param user The key's user.
@@ -83,6 +91,18 @@ export const handler: MiddlewareHandler<State>[] = [
 
       if (isFromPolytech) {
         context.state.session = session;
+
+        if (Object.values(session.memberOf).some(
+          (value) => typeof value === "string" && value.includes("cn=amu:ufr:polytech:personnels")
+        )) {
+          context.state.role = "personnels";
+        } else if (Object.values(session.memberOf).some(
+          (value) => typeof value === "string" && value.includes("cn=amu:ufr:polytech:etudiants")
+        )) {
+          context.state.role = "etudiants";
+        } else {
+          context.state.role = "autres";
+        }
       }
     }
 
@@ -111,7 +131,7 @@ export const handler: MiddlewareHandler<State>[] = [
         });
       }
 
-      if (context.state.isAuthenticated && !context.state.isFromPolytech) {
+      if (!context.state.isFromPolytech) {
         return new Response(null, {
           status: 403,
           headers: {
@@ -119,6 +139,12 @@ export const handler: MiddlewareHandler<State>[] = [
           },
         });
       }
+
+      if (isRouteAnAPI(url.pathname) && !(context.state.role == "personnels")) {
+        return new Response(null, {
+          status: 403,
+        });
+      }
     }
 
     return await context.next();