Gates routes on a session token, and on a permission after it. The routers
put these middleware before a handler; a route open to anonymous callers
calls parseOptionalAuth (lib/auth.ts) instead.
Requires a valid session token in the Authorization header, and puts its
payload in ctx.state.user for the rest of the route.
Returns a middleware that requires the caller to hold permission. It must
run after authMiddleware, as in
router.patch(path, authMiddleware, requirePermission("user:manage"), …).
The returned middleware throws an APIException (403) when the caller
lacks the permission.
Set on ctx.state by authMiddleware for the handlers after it.
user carries the caller's live role, not the one in their token.
The context type of a handler behind authMiddleware. Pass the route
path, as in AuthContext<"/:key/role">, to keep ctx.params typed.
Usage
import * as mod from "api/middleware/auth.ts";