u

src/db/companyuser.js

@@ -1,4 +1,53 @@
-import { getStore } from './store.js';
+import { getStore, getProvider } from './store.js';
+
+export async function resolveCompanyAccess(googleAuthId, companyId) {
+    const provider = await getProvider();
+    const access = await provider.query(
+        `SELECT company_id, role FROM companyuser WHERE company_id = @companyId AND google_auth_id = @googleAuthId`,
+        { companyId, googleAuthId }
+    );
+    const accessRow = access.rows[0] ?? null;
+    if (!accessRow) {
+        const exists = await provider.query(
+            `SELECT id FROM company WHERE id = @companyId`,
+            { companyId }
+        );
+        if (!exists.rows[0]) {
+            throw new Error('Company not found');
+        }
+        throw new Error('Not authorized');
+    }
+    return {
+        companyId: accessRow.company_id,
+        role: accessRow.role ?? 'user',
+    };
+}
+
+export async function resolveSelectedCompanyAccess(googleAuthId) {
+    const store = await getStore();
+    const user = await store.google_auth.getById(googleAuthId);
+    const companyId = user?.selectedCompanyId ?? null;
+    if (companyId == null) {
+        throw new Error('No company selected');
+    }
+    return resolveCompanyAccess(googleAuthId, companyId);
+}
+
+export async function requireCompanyAdmin(googleAuthId, companyId) {
+    const ctx = await resolveCompanyAccess(googleAuthId, companyId);
+    if (ctx.role !== 'admin') {
+        throw new Error('Not authorized');
+    }
+    return ctx;
+}
+
+export async function requireSelectedCompanyAdmin(googleAuthId) {
+    const ctx = await resolveSelectedCompanyAccess(googleAuthId);
+    if (ctx.role !== 'admin') {
+        throw new Error('Not authorized');
+    }
+    return ctx;
+}
 
 export async function list(googleAuthId) {
     const store = await getStore();