hooks.server.ts RawHistoryFolder

1import type { Handle } from "@sveltejs/kit";
2import { validateSessionToken } from "$lib/api/session.server";
3import { setSessionTokenCookie, deleteSessionTokenCookie } from "$lib/api/session.cookie";
4import { initializeDatabase } from "$lib/db/db.server";
5import { handleRateLimit } from "$lib/api/rate-limiter";
6
7// Initialize database when the server starts
8console.debug("Initializing database on server start...");
9initializeDatabase().catch(error => {
10    console.error('Failed to initialize database:', error);
11});
12
13export const handle: Handle = async ({ event, resolve }) => {
14    console.debug("Handling request:", event.url.pathname);
15    
16    // Apply rate limiting for API routes
17    const rateLimitResponse = await handleRateLimit(event);
18    if (rateLimitResponse) {
19        return rateLimitResponse;
20    }
21    
22    // Check if this is a public chat messages request
23    const isPublicChatRequest = 
24        event.url.pathname === '/api/chat/messages' && 
25        event.url.searchParams.get('public') === 'true' &&
26        event.request.method === 'GET';
27    
28    // Check if this is a public room request
29    const isPublicRoomRequest = 
30        event.url.pathname.startsWith('/api/rooms/') && 
31        event.url.searchParams.get('public') === 'true' &&
32        event.request.method === 'GET';
33    
34    // Public routes that don't require authentication
35    const publicRoutes = [
36        "/",
37        "/api/session/login",
38        "/api/session/validate",
39        "/api/register",
40        "/login",
41        "/register"
42    ];
43    
44    // Get session token from cookies
45    const token = event.cookies.get("session") ?? null;
46
47    // Handle public requests separately: always clear session
48    if (isPublicChatRequest || isPublicRoomRequest) {
49        console.debug("Public request accessed:", event.url.pathname);
50        event.locals.user = null;
51        event.locals.session = null; // Public access doesn't require a session
52        return resolve(event);
53    }
54    
55    // Handle public routes: if token exists, validate and propagate
56    if (publicRoutes.includes(event.url.pathname)) {
57        console.debug("Public route accessed:", event.url.pathname);
58        if (token) {
59            const { session, user } = await validateSessionToken(token);
60            if (session !== null) {
61                console.debug("Valid session found on public route for user:", user?.nickname);
62                setSessionTokenCookie(event, token, session.expiresAt);
63                event.locals.session = session;
64                event.locals.user = user;
65            }
66        }
67        return resolve(event);
68    }
69
70    // Protected routes: ensure authentication
71    if (token === null) {
72        console.debug("No session token found");
73        event.locals.user = null;
74        event.locals.session = null;
75        return new Response("Unauthorized", { status: 401 });
76    }
77    
78    const { session, user } = await validateSessionToken(token);
79    if (session !== null) {
80        console.debug("Valid session found for user:", user?.nickname);
81        setSessionTokenCookie(event, token, session.expiresAt);
82        event.locals.session = session;
83        event.locals.user = user;
84        return resolve(event);
85    } else {
86        console.debug("Invalid session token");
87        deleteSessionTokenCookie(event);
88        event.locals.session = null;
89        event.locals.user = null;
90        return new Response("Unauthorized", { status: 401 });
91    }
92};