21b9f03e9d
- Custom error classes (lib/errors.ts) and signed-cookie session (lib/auth/session.ts, HMAC-SHA256, httpOnly+sameSite=lax) - UserRepository + AuthService (bcrypt hashing, role/status checks, register/login/logout/getCurrentUser/updateProfile) - Auth helpers (getCurrentUser), user validator, API error handler - API routes: register (auto-login), login, logout, me, PATCH users/me, GET admin/migrations (admin-only guard) - middleware.ts redirects unauthenticated page access to /login - Screens: login (login/register toggle), profile, dashboard skeleton, home redirect - vitest: exclude e2e specs, setupFiles for SESSION_SECRET - playwright: run migrate before dev server, set SESSION_SECRET - Unit tests (UserRepository, AuthService, session), integration auth-flow, e2e auth.spec (register/login/logout/protected/401)
26 lines
1008 B
TypeScript
26 lines
1008 B
TypeScript
import { NextResponse, type NextRequest } from 'next/server';
|
||
import { SESSION_COOKIE } from '@/lib/auth/constants';
|
||
|
||
/**
|
||
* 認証ミドルウェア（Edge Runtime）。
|
||
* セッションCookieの「存在」のみを確認し、未所持なら保護画面を /login へリダイレクトする。
|
||
* HMAC検証・DB参照はNode.js RuntimeのgetCurrentUserで行う（ここでは行わない）。
|
||
* APIルートは各Route Handlerで401を返すため、本ミドルウェアの対象外とする。
|
||
*/
|
||
export function middleware(request: NextRequest) {
|
||
const token = request.cookies.get(SESSION_COOKIE)?.value;
|
||
if (!token) {
|
||
const loginUrl = new URL('/login', request.url);
|
||
loginUrl.searchParams.set('redirect', request.nextUrl.pathname);
|
||
return NextResponse.redirect(loginUrl);
|
||
}
|
||
return NextResponse.next();
|
||
}
|
||
|
||
export const config = {
|
||
matcher: [
|
||
// /login, /api, _next 静的 assets, favicon を除外
|
||
'/((?!login|api|_next/static|_next/image|favicon.ico).*)',
|
||
],
|
||
};
|