Merge current features with security hardening and automatic safe initialization

src/lib/staff/auth.ts

@@ -0,0 +1,31 @@
+import { redirect } from "next/navigation";
+import { UserRole } from "@prisma/client";
+import { requireKitaSession } from "@/lib/auth-utils";
+import { prisma } from "@/lib/prisma";
+import type { StaffActor } from "./service";
+
+export async function requireStaffActor(): Promise<StaffActor> {
+  const { user } = await requireKitaSession();
+  const current = await prisma.user.findFirst({
+    where: { id: user.id, kitaId: user.kitaId },
+    select: {
+      id: true,
+      kitaId: true,
+      role: true,
+      lockedUntil: true,
+      disabledAt: true,
+      emailVerifiedAt: true,
+      privacyPolicyAcceptedAt: true,
+    },
+  });
+  if (
+    !current?.kitaId ||
+    !current.privacyPolicyAcceptedAt ||
+    !!current.disabledAt || !current.emailVerifiedAt ||
+    current.role !== user.role ||
+    (current.role !== UserRole.ADMIN && current.role !== UserRole.ERZIEHER) ||
+    (current.lockedUntil && current.lockedUntil > new Date())
+  )
+    redirect("/forbidden");
+  return { id: current.id, kitaId: current.kitaId, role: current.role };
+}