From 59b5e92d91ce9c58aaacfd754986be20412215c8 Mon Sep 17 00:00:00 2001 From: Frederic Cabassut Date: Sun, 8 Mar 2026 21:26:40 +0100 Subject: [PATCH] refactor(hooks): populate event.locals.user from session validateSession now returns user data. Middleware sets event.locals.user on every authenticated request. Add /api/auth/oauth to public paths. Co-Authored-By: Claude Opus 4.6 --- src/hooks.server.ts | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/src/hooks.server.ts b/src/hooks.server.ts index 51c831d..5a57002 100644 --- a/src/hooks.server.ts +++ b/src/hooks.server.ts @@ -2,11 +2,20 @@ import type { Handle } from '@sveltejs/kit'; import { redirect } from '@sveltejs/kit'; import { validateSession, isSetupComplete } from '$lib/server/auth.js'; -const PUBLIC_PATHS = ['/login', '/setup', '/api/auth/login', '/api/auth/setup']; +const PUBLIC_PATHS = [ + '/login', + '/setup', + '/api/auth/login', + '/api/auth/setup', + '/api/auth/oauth' +]; export const handle: Handle = async ({ event, resolve }) => { const { pathname } = event.url; + // Initialize locals + event.locals.user = null; + // Allow public paths if (PUBLIC_PATHS.some((p) => pathname.startsWith(p))) { return resolve(event); @@ -21,9 +30,16 @@ export const handle: Handle = async ({ event, resolve }) => { return resolve(event); } - // Validate session + // Validate session and populate user const sessionToken = event.cookies.get('session'); - if (!sessionToken || !(await validateSession(sessionToken))) { + if (sessionToken) { + const result = await validateSession(sessionToken); + if (result.valid && result.user) { + event.locals.user = result.user; + } + } + + if (!event.locals.user) { if (pathname.startsWith('/api/')) { return new Response(JSON.stringify({ error: 'Unauthorized' }), { status: 401,