Request path

import { verifyJWT, attachRole, authorizeRoute, injectRLSContext } from './stages';
import { generalApiLimiter } from './limits';

// Every protected router mounts the same four stages, in this order.
export const protect = [verifyJWT, attachRole, authorizeRoute, injectRLSContext];

app.use('/api/', generalApiLimiter);
app.use('/api/auth', authRouter);                    // Better Auth handlers, no chain
app.use('/api/courses',       protect, coursesRouter);
app.use('/api/resources',     protect, resourcesRouter);
app.use('/api/questionnaires',protect, questionnairesRouter);
app.use('/api/admin',         protect, adminRouter);  // authorizeRoute limits this to admin

import { pool } from '../db/pool';           // direct pg Pool, no PgBouncer

export async function injectRLSContext(req, res, next) {
  const client = await pool.connect();
  let finished = false;
  const end = async (cmd: 'COMMIT' | 'ROLLBACK') => {
    if (finished) return; finished = true;
    try { await client.query(cmd); } finally { client.release(); }
  };
  try {
    await client.query('BEGIN');
    // set_config(..., true) is the parameterisable form of SET LOCAL
    await client.query(
      "SELECT set_config('app.current_user_id', $1, true), set_config('app.current_role', $2, true)",
      [req.user.id, req.role]);
    req.db = client;
    res.on('finish', () => end(res.statusCode < 400 ? 'COMMIT' : 'ROLLBACK'));
    res.on('close',  () => end('ROLLBACK'));   // client aborted
    next();
  } catch (e) { await end('ROLLBACK'); next(e); }
}