feat: annotated client routes

server/api/v1/client/auth/callback/index.post.ts

@@ -1,30 +1,41 @@
+import { type } from "arktype";
+import { readDropValidatedBody, throwingArktype } from "~/server/arktype";
+import aclManager from "~/server/internal/acls";
 import clientHandler from "~/server/internal/clients/handler";
-import sessionHandler from "~/server/internal/session";
 
-export default defineEventHandler(async (h3) => {
-  const user = await sessionHandler.getSession(h3);
-  if (!user) throw createError({ statusCode: 403 });
+const AuthorizeBody = type({
+  id: "string",
+}).configure(throwingArktype);
 
-  const body = await readBody(h3);
-  const clientId = await body.id;
+/**
+ * Finalize the authorization for a client
+ */
+export default defineEventHandler<{ body: typeof AuthorizeBody.infer }>(
+  async (h3) => {
+    const userId = await aclManager.getUserIdACL(h3, []);
+    if (!userId) throw createError({ statusCode: 403 });
 
-  const client = await clientHandler.fetchClient(clientId);
-  if (!client)
-    throw createError({
-      statusCode: 400,
-      statusMessage: "Invalid or expired client ID.",
-    });
+    const body = await readDropValidatedBody(h3, AuthorizeBody);
+    const clientId = body.id;
 
-  if (client.userId != user.userId)
-    throw createError({
-      statusCode: 403,
-      statusMessage: "Not allowed to authorize this client.",
-    });
+    const client = await clientHandler.fetchClient(clientId);
+    if (!client)
+      throw createError({
+        statusCode: 400,
+        statusMessage: "Invalid or expired client ID.",
+      });
 
-  const token = await clientHandler.generateAuthToken(clientId);
+    if (client.userId != userId)
+      throw createError({
+        statusCode: 403,
+        statusMessage: "Not allowed to authorize this client.",
+      });
 
-  return {
-    redirect: `drop://handshake/${clientId}/${token}`,
-    token: `${clientId}/${token}`,
-  };
-});
+    const token = await clientHandler.generateAuthToken(clientId);
+
+    return {
+      redirect: `drop://handshake/${clientId}/${token}`,
+      token: `${clientId}/${token}`,
+    };
+  },
+);