everythingbutwork/apps/api/src/auth/middleware.ts

// Fastify-Decorator: macht `req.cockpitUser` verfügbar, wenn die Session gültig ist.
// Die Typaugmentation lebt in `../types.ts`, damit sie auch in tRPC-Imports
// gezogen wird (web → api Type-Only-Import).

import '../types.js';
import type { FastifyInstance, FastifyRequest } from 'fastify';
import { loadEnv } from '../env.js';
import { getSessionWithUser } from './session.js';

export async function registerAuthMiddleware(app: FastifyInstance): Promise<void> {
  const env = loadEnv();

  app.decorateRequest('cockpitUser', null);
  app.decorateRequest('cockpitSessionId', null);

  app.addHook('onRequest', async (req: FastifyRequest) => {
    const sessionId = req.cookies[env.SESSION_COOKIE_NAME];
    if (!sessionId) return;
    const found = await getSessionWithUser(sessionId);
    if (found) {
      req.cockpitUser = found.user;
      req.cockpitSessionId = sessionId;
    }
  });
}