feat: auth

api/src/app/middleware/admin-guard.ts

@@ -0,0 +1,21 @@
+/**
+ * @copyright 2026 NHCarrigan
+ * @license Naomi's Public License
+ * @author Naomi Carrigan
+ */
+
+import { FastifyReply, FastifyRequest } from "fastify";
+
+/**
+ * Middleware to check if the authenticated user is an admin.
+ * Must be used after app.authenticate.
+ */
+export async function adminGuard(
+  request: FastifyRequest,
+  reply: FastifyReply
+): Promise<void> {
+  const user = request.user as any;
+  if (!user || !user.isAdmin) {
+    return reply.code(403).send({ error: "Forbidden: Admin access required" });
+  }
+}