initial commit

server/middleware/auth.ts

@@ -0,0 +1,11 @@
+const PUBLIC_ROUTES = ['/api/session', '/api/login']
+
+export default defineEventHandler(async (event) => {
+  const path = event.path.split('?')[0]!
+  if (!path.startsWith('/api/') || PUBLIC_ROUTES.includes(path)) return
+
+  const session = await diarySession(event)
+  if (!session.data.unlocked) {
+    throw createError({ statusCode: 401, statusMessage: 'The diary is locked' })
+  }
+})