SWAMPy

✎ CARVE FLESH

EDITING: AuthMiddleware.php

<?php
/**
 * Flora and Creations — Authentication Middleware
 *
 * Verifies the JWT token from the Authorization header,
 * decodes it, and attaches user info to the request context.
 */

namespace App\Middleware;

use App\Auth;
use App\Utils\Response;

class AuthMiddleware
{
    /**
     * Run the authentication middleware.
     *
     * @param string $method  HTTP method
     * @param string $path    Request path
     */
    public function __invoke(string $method, string $path): void
    {
        // Determine if this route requires auth
        $requiresAuth = $this->pathRequiresAuth($path);

if (!$requiresAuth) {
            return;
        }

$authHeader = $_SERVER['HTTP_AUTHORIZATION'] ?? '';

// Handle "Bearer " prefix
        if (str_starts_with($authHeader, 'Bearer ')) {
            $authHeader = substr($authHeader, 7);
        }

if (empty($authHeader)) {
            Response::unauthorized('Missing authentication token.');
        }

try {
            $payload = Auth::verify($authHeader);
        } catch (\Exception $e) {
            Response::unauthorized('Invalid or expired authentication token.');
        }

// Check role restrictions for admin/staff-only routes.
        // NOTE: /account is the customer account area — any authenticated
        // user (customer, staff, or admin) may use it. Only /admin routes
        // are restricted to admin/staff roles.
        if (str_starts_with($path, '/admin')) {
            $role = $payload['role'] ?? 'customer';
            if (!in_array($role, ['admin', 'staff'])) {
                Response::forbidden('Insufficient permissions.');
            }
        }

// Store decoded payload in super-global for controllers to access
        $_SERVER['AUTH_USER'] = $payload;
    }

/**
     * Determine if the given path requires authentication.
     */
    private function pathRequiresAuth(string $path): bool
    {
        $protected = [
            '/account',
            '/admin',
            '/auth/me',
        ];

foreach ($protected as $prefix) {
            if (str_starts_with($path, $prefix)) {
                return true;
            }
        }

return false;
    }
}

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📄 AuthMiddleware.php	PHP	2.3 KB	2026-07-15 09:17	EDIT
📄 CorsMiddleware.php	PHP	1.4 KB	2026-07-15 09:17	EDIT