The BFF trust boundary

How auth actually works, prose bound to the server code: the global guard, the httpOnly cookie session, and the authed client that refreshes on 401.

src/hooks.server.ts48 lines · handle L5–47
Outline 1 symbolshandle function export
1import { redirect, type Handle } from '@sveltejs/kit';
2import { lqFetch } from '$lib/server/lqClient';
3import { AT_COOKIE } from '$lib/server/session';
4
5export const handle: Handle = async ({ event, resolve }) => {
event.locals.user = null;
event.locals.mustChangePassword = false;
8
if (event.cookies.get(AT_COOKIE)) {
const res = await lqFetch(event, '/api/v1/users/me');
if (res.status === 200) {
	const user = await res.json();
	event.locals.user = user;
	event.locals.mustChangePassword = !!user.must_change_password;
} else if (res.status === 403) {
	const body = await res.json().catch(() => ({}) as Record<string, unknown>);
	const code = body?.error?.code ?? body?.detail;
	if (code === 'password_change_required') event.locals.mustChangePassword = true;
}
}
21
const id = event.route.id ?? '';
const isApp = id.startsWith('/(app)');
const isAuth = id.startsWith('/(auth)');
const path = event.url.pathname;
26
// Forced first-run password rotation takes precedence.
if (event.locals.mustChangePassword && path !== '/change-password') {
throw redirect(303, '/change-password');
}
// Protect app routes.
if (isApp && !event.locals.user) {
throw redirect(303, `/login?next=${encodeURIComponent(path)}`);
}
// Authed users skip the auth screens — except /change-password, which they may
// visit voluntarily (e.g. from Settings) to rotate their password.
if (
isAuth &&
event.locals.user &&
!event.locals.mustChangePassword &&
path !== '/change-password'
) {
throw redirect(303, '/');
}
45
return resolve(event);
47};
48

No results