0eaf809bc6
Configure Microsoft Entra ID as the sole SSO provider with allowDangerousEmailAccountLinking to link SSO accounts to existing seeded user records by email match. Add signIn event for automatic org assignment by domain. Guard DEV_BYPASS_AUTH against production use. Add branded pending page for authenticated users without org membership. Remove Google provider for initial rollout simplicity. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
49 lines
1.4 KiB
TypeScript
49 lines
1.4 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { auth } from "@/lib/auth";
|
|
|
|
export async function getAuthSession() {
|
|
// Dev bypass: return a mock session pointing to the seeded dev user (never in production)
|
|
if (process.env.DEV_BYPASS_AUTH === "true" && process.env.NODE_ENV !== "production") {
|
|
const devUserId = process.env.DEV_USER_ID ?? "dev-user-001";
|
|
return {
|
|
session: {
|
|
user: {
|
|
id: devUserId,
|
|
name: "Dev User",
|
|
email: "dev@localhost",
|
|
role: "ADMIN" as const,
|
|
organizationId: "dev-org-001",
|
|
},
|
|
expires: new Date(Date.now() + 86400000).toISOString(),
|
|
},
|
|
error: null,
|
|
};
|
|
}
|
|
|
|
const session = await auth();
|
|
if (!session?.user?.id) {
|
|
return { session: null, error: unauthorized() };
|
|
}
|
|
return { session, error: null };
|
|
}
|
|
|
|
export function unauthorized() {
|
|
return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
|
|
}
|
|
|
|
export function badRequest(message: string) {
|
|
return NextResponse.json({ error: message }, { status: 400 });
|
|
}
|
|
|
|
export function forbidden(message = "Forbidden") {
|
|
return NextResponse.json({ error: message }, { status: 403 });
|
|
}
|
|
|
|
export function notFound(message = "Not found") {
|
|
return NextResponse.json({ error: message }, { status: 404 });
|
|
}
|
|
|
|
export function serverError(error: unknown) {
|
|
console.error(error);
|
|
return NextResponse.json({ error: "Internal server error" }, { status: 500 });
|
|
}
|