refactor: impede de admin acessar

src/composables/useAuth.js

@@ -2,6 +2,19 @@ import { api } from "src/boot/axios";
 import { Cookies } from "quasar";
 import { permissionStore } from "src/stores/permission";
 import { userStore } from "src/stores/user";
+import { clearAuthSession, isOwnerUser } from "src/helpers/authAccess";
+
+const assertOwnerAccess = (user) => {
+  if (isOwnerUser(user)) {
+    return;
+  }
+
+  clearAuthSession();
+
+  const error = new Error("Acesso permitido apenas para proprietários.");
+  error.response = { data: { message: error.message } };
+  throw error;
+};
 
 export const useAuth = () => {
   const login = async (email, password) => {
@@ -13,6 +26,7 @@ export const useAuth = () => {
 
       if (response.status === 200) {
         const payload = response.data.payload;
+        assertOwnerAccess(payload.user);
 
         const accessTokenExpiresIn = new Date(
           new Date().getTime() + payload.expires_in * 1000,
@@ -68,6 +82,7 @@ export const useAuth = () => {
 
       if (response.status === 200) {
         const payload = response.data.payload;
+        assertOwnerAccess(payload.user);
 
         const accessTokenExpiresIn = new Date(
           new Date().getTime() + payload.expires_in * 1000,

src/helpers/authAccess.js

@@ -0,0 +1,17 @@
+import { Cookies } from "quasar";
+
+const OWNER_USER_TYPE_ID = 3;
+
+export const isOwnerUser = (user) => {
+  const description = String(
+    user?.user_type?.description ?? user?.type ?? "",
+  ).toLowerCase();
+  const userTypeId = Number(user?.user_type_id ?? user?.user_type?.value);
+
+  return description === "owner" || userTypeId === OWNER_USER_TYPE_ID;
+};
+
+export const clearAuthSession = () => {
+  Cookies.remove("access_token");
+  Cookies.remove("refresh_token");
+};

src/router/index.js

@@ -10,6 +10,8 @@ import {
 import { permissionStore } from "src/stores/permission";
 import { route } from "quasar/wrappers";
 import { useI18n } from "vue-i18n";
+import { userStore } from "src/stores/user";
+import { clearAuthSession, isOwnerUser } from "src/helpers/authAccess";
 
 import routes from "./routes";
 
@@ -49,6 +51,30 @@ export default route(function (/* { store, ssrContext } */) {
     }
 
     if (access_token) {
+      const currentUserStore = userStore();
+
+      try {
+        if (!currentUserStore.user) {
+          await currentUserStore.fetchUser();
+        }
+      } catch {
+        clearAuthSession();
+        currentUserStore.resetUser();
+        permissionStore().resetScopes();
+        return next({ name: "LoginPage" });
+      }
+
+      if (!isOwnerUser(currentUserStore.user)) {
+        clearAuthSession();
+        currentUserStore.resetUser();
+        permissionStore().resetScopes();
+        Notify.create({
+          message: "Acesso permitido apenas para proprietários.",
+          type: "negative",
+        });
+        return next({ name: "LoginPage" });
+      }
+
       if (to.name == "LoginPage") {
         return next({ name: "DashboardPage" });
       }