feat: add cerbos access control

api/routes/account/create.ts

@@ -13,6 +13,7 @@ export default create.access("public").handle(async ({ body: { name, email } })
     .create()
     .addName(name)
     .addEmailStrategy(email)
+    .addRole("user")
     .save()
     .then((account) => account.id);
 });

api/routes/account/get-by-id.ts

@@ -0,0 +1,17 @@
+import { ForbiddenError } from "@spec/relay/mod.ts";
+import { NotFoundError } from "@spec/relay/mod.ts";
+import { getById } from "@spec/schemas/account/routes.ts";
+
+import { db } from "~stores/read-store/database.ts";
+
+export default getById.access("authenticated").handle(async ({ params: { id } }, { access }) => {
+  const account = await db.collection("accounts").findOne({ id });
+  if (account === null) {
+    return new NotFoundError();
+  }
+  const decision = await access.isAllowed({ kind: "account", id: account.id, attributes: {} }, "read");
+  if (decision === false) {
+    return new ForbiddenError();
+  }
+  return account;
+});

api/routes/auth/code.ts

@@ -70,7 +70,7 @@ export default code.access("public").handle(async ({ params: { accountId, codeId
       status: 302,
       headers: {
         location: next,
-        "set-cookie": cookie.serialize("token", await auth.generate({ accountId: account.id }, "1 week"), options),
+        "set-cookie": cookie.serialize("token", await auth.generate({ id: account.id }, "1 week"), options),
       },
     });
   }
@@ -78,7 +78,7 @@ export default code.access("public").handle(async ({ params: { accountId, codeId
   return new Response(null, {
     status: 200,
     headers: {
-      "set-cookie": cookie.serialize("token", await auth.generate({ accountId: account.id }, "1 week"), options),
+      "set-cookie": cookie.serialize("token", await auth.generate({ id: account.id }, "1 week"), options),
     },
   });
 });

api/routes/auth/password.ts

@@ -8,7 +8,7 @@ import { password } from "~libraries/crypto/mod.ts";
 import { logger } from "~libraries/logger/mod.ts";
 import { getPasswordStrategyByAlias } from "~stores/read-store/methods.ts";
 
-export default route.handle(async ({ body: { alias, password: userPassword } }) => {
+export default route.access("public").handle(async ({ body: { alias, password: userPassword } }) => {
   const strategy = await getPasswordStrategyByAlias(alias);
   if (strategy === undefined) {
     return logger.info({
@@ -28,7 +28,7 @@ export default route.handle(async ({ body: { alias, password: userPassword } })
     headers: {
       "set-cookie": cookie.serialize(
         "token",
-        await auth.generate({ accountId: strategy.accountId }, "1 week"),
+        await auth.generate({ id: strategy.accountId }, "1 week"),
         config.cookie(1000 * 60 * 60 * 24 * 7),
       ),
     },

api/routes/auth/session.ts

@@ -3,8 +3,8 @@ import { session } from "@spec/schemas/auth/routes.ts";
 
 import { getAccountById } from "~stores/read-store/methods.ts";
 
-export default session.access("session").handle(async ({ accountId }) => {
-  const account = await getAccountById(accountId);
+export default session.access("authenticated").handle(async ({ principal }) => {
+  const account = await getAccountById(principal.id);
   if (account === undefined) {
     return new UnauthorizedError();
   }