Files
OpenSquawk/server/middleware/auth.global.ts
itsrubberduck 3172516918 feat(websim): browser A320 cockpit to test /live-atc without MSFS (WIP)
Flight model (ground/air physics, SELECTED/NAV/APPR/AUTOLAND autopilot with
STAR sequencing and ILS capture), bridge client that feeds the existing
/api/bridge/* endpoints so /live-atc can't tell it apart from a real bridge,
and the cockpit UI (PFD reuse, FCU, radio panel, Leaflet ND, three.js
exterior, spawn presets at EDDF/EDDS). Design doc:
docs/plans/2026-07-16-websim-design.md.

Also adds a local-dev-only auto-login (/dev-login, server/api/dev/login.post.ts)
that bypasses the invite-only login and MongoDB entirely via a fixed in-memory
user, so require-auth pages are reachable for local testing even when the dev
DB is unreachable. Hard-disabled outside development.

Status: unit tests green (yarn test) and typecheck clean (yarn typecheck).
Browser walkthrough of the actual cockpit (flying a preset, confirming
telemetry reaches /live-atc) is not yet done — picking up from a fresh dev
server + /dev-login?redirect=/flightlab/websim confirmed the spawn screen
renders past auth, but full instrument/map/exterior verification is still
outstanding.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-16 18:49:31 +02:00

27 lines
654 B
TypeScript

import {defineEventHandler, getRequestURL} from 'h3'
import {requireUserSession} from '../utils/auth'
export default defineEventHandler(async (event) => {
const url = getRequestURL(event)
if (!url.pathname.startsWith('/api/')) {
return
}
if (url.pathname.startsWith('/api/service/')) {
return
}
if (url.pathname.startsWith('/api/bridge/')) {
return
}
if (url.pathname.startsWith('/api/copilot/')) {
return
}
if (url.pathname.startsWith('/api/dev/')) {
return
}
if (event.node.req.method === 'OPTIONS') {
return
}
await requireUserSession(event)
})