@aifabrix/miso-client 4.10.0 → 4.13.0

package/README.md

@@ -138,7 +138,7 @@ REDIS_HOST=localhost
 ### Step 3: Use It
 
 ```typescript
-import { MisoClient, loadConfig } from '@aifabrix/miso-client';
+import { MisoClient, loadConfig } from "@aifabrix/miso-client";
 
 const client = new MisoClient(loadConfig());
 await client.initialize();
@@ -157,7 +157,7 @@ For React, Vue, Angular, or other front-end applications, use **DataClient** - a
 **⚠️ Security Warning:** Never expose `clientSecret` in browser/client-side code. Use the Server-Provided Client Token Pattern instead.
 
 ```typescript
-import { DataClient } from '@aifabrix/miso-client';
+import { DataClient } from "@aifabrix/miso-client";
 
 // Server provides client token (from initial page load or API endpoint)
 const initialClientToken = window.INITIAL_CLIENT_TOKEN; // From server
@@ -165,20 +165,20 @@ const tokenExpiresAt = window.INITIAL_CLIENT_TOKEN_EXPIRES_AT;
 
 // Browser-safe configuration WITHOUT clientSecret
 const dataClient = new DataClient({
-  baseUrl: 'https://api.example.com',
+  baseUrl: "https://api.example.com",
   misoConfig: {
-    controllerUrl: 'https://controller.aifabrix.ai',
-    clientId: 'ctrl-dev-my-app',
+    controllerUrl: "https://controller.aifabrix.ai",
+    clientId: "ctrl-dev-my-app",
     // ❌ DO NOT include clientSecret in browser code
-    
+
     // ✅ Use server-provided token
     clientToken: initialClientToken,
     clientTokenExpiresAt: tokenExpiresAt,
-    
+
     // ✅ Refresh callback calls your server endpoint
     onClientTokenRefresh: async () => {
-      const response = await fetch('/api/client-token', {
-        credentials: 'include', // Include cookies for auth
+      const response = await fetch("/api/client-token", {
+        credentials: "include", // Include cookies for auth
       });
       return await response.json(); // { token: string, expiresIn: number }
     },
@@ -186,8 +186,8 @@ const dataClient = new DataClient({
 });
 
 // Make authenticated requests with automatic audit logging
-const users = await dataClient.get('/api/users');
-const newUser = await dataClient.post('/api/users', { name: 'John' });
+const users = await dataClient.get("/api/users");
+const newUser = await dataClient.post("/api/users", { name: "John" });
 
 // OAuth callback is automatically handled on initialization
 // Token is extracted from URL hash fragment (#token=...) and stored securely
@@ -195,15 +195,26 @@ const newUser = await dataClient.post('/api/users', { name: 'John' });
 
 // Token refresh callback (automatic refresh on 401 errors)
 const dataClientWithRefresh = new DataClient({
-  baseUrl: 'https://api.example.com',
-  misoConfig: { /* ... */ },
+  baseUrl: "https://api.example.com",
+  misoConfig: {
+    /* ... */
+  },
   onTokenRefresh: async () => {
     // Call your backend endpoint that handles refresh token securely
-    const response = await fetch('/api/refresh-token', {
-      credentials: 'include', // Include cookies for auth
+    const response = await fetch("/api/refresh-token", {
+      credentials: "include", // Include cookies for auth
     });
     return await response.json(); // { token: string, expiresIn: number }
   },
+
+  // Optional cookie-first restore callback (preferred for enterprise SSO)
+  onSessionRestore: async () => {
+    const response = await fetch("/api/session/restore", {
+      credentials: "include",
+    });
+    if (!response.ok) return null;
+    return await response.json(); // { token: string, expiresAt?: string }
+  },
 });
 ```
 
@@ -243,7 +254,7 @@ aifabrix run miso-controller
 **What happens:** Your app validates user tokens from Keycloak.
 
 ```typescript
-import { MisoClient, loadConfig } from '@aifabrix/miso-client';
+import { MisoClient, loadConfig } from "@aifabrix/miso-client";
 
 // Create client (loads from .env automatically)
 const client = new MisoClient(loadConfig());
@@ -256,7 +267,7 @@ if (token) {
   const isValid = await client.validateToken(token);
   if (isValid) {
     const user = await client.getUser(token);
-    console.log('User:', user);
+    console.log("User:", user);
   }
 }
 ```
@@ -284,7 +295,7 @@ const result = await client.exchangeUserToken(entraOrExternalToken);
 **What happens:** Check user roles to control access. Roles are cached in Redis for performance. Token validation is also cached (15-minute TTL) to reduce API calls.
 
 ```typescript
-import { MisoClient, loadConfig } from '@aifabrix/miso-client';
+import { MisoClient, loadConfig } from "@aifabrix/miso-client";
 
 // Build on Step 3 - add Redis in .env file
 const client = new MisoClient(loadConfig());
@@ -293,7 +304,7 @@ await client.initialize();
 const token = client.getToken(req);
 
 // Check if user has role
-const isAdmin = await client.hasRole(token, 'admin');
+const isAdmin = await client.hasRole(token, "admin");
 const roles = await client.getRoles(token);
 
 // Gate features by role
@@ -316,7 +327,7 @@ if (isAdmin) {
 **Basic Logging:**
 
 ```typescript
-import { MisoClient, loadConfig } from '@aifabrix/miso-client';
+import { MisoClient, loadConfig } from "@aifabrix/miso-client";
 
 // Client token is automatically managed - no API key needed
 const client = new MisoClient(loadConfig());
@@ -326,21 +337,19 @@ const token = client.getToken(req);
 const user = await client.getUser(token);
 
 // Log messages
-await client.log.info('User accessed dashboard', { userId: user?.id });
-await client.log.error('Operation failed', { error: err.message });
-await client.log.warn('Unusual activity', { details: '...' });
+await client.log.info("User accessed dashboard", { userId: user?.id });
+await client.log.error("Operation failed", { error: err.message });
+await client.log.warn("Unusual activity", { details: "..." });
 ```
 
 **Fluent API with Request Context (Express):**
 
 ```typescript
-import { Request } from 'express';
+import { Request } from "express";
 
 // Auto-extract context from Express Request
-app.get('/api/users', async (req: Request, res) => {
-  await client.log
-    .withRequest(req)
-    .info('Users list accessed');
+app.get("/api/users", async (req: Request, res) => {
+  await client.log.withRequest(req).info("Users list accessed");
   // Automatically includes: IP, method, path, userAgent, correlationId, userId
 });
 ```
@@ -348,21 +357,21 @@ app.get('/api/users', async (req: Request, res) => {
 **Indexed Context for Fast Queries:**
 
 ```typescript
-import { extractLoggingContext } from '@aifabrix/miso-client';
+import { extractLoggingContext } from "@aifabrix/miso-client";
 
 const logContext = extractLoggingContext({
   source: {
-    key: 'datasource-1',
-    displayName: 'PostgreSQL DB',
-    externalSystem: { key: 'system-1', displayName: 'External API' }
+    key: "datasource-1",
+    displayName: "PostgreSQL DB",
+    externalSystem: { key: "system-1", displayName: "External API" },
   },
-  record: { key: 'record-123', displayName: 'User Profile' }
+  record: { key: "record-123", displayName: "User Profile" },
 });
 
 await client.log
   .withIndexedContext(logContext)
   .withContext({ correlationId, userId })
-  .error('Sync failed');
+  .error("Sync failed");
 ```
 
 **What happens to logs?** They're sent to the Miso Controller for centralized monitoring and analysis. Client token is automatically included. Indexed context fields enable fast database queries for observability and compliance.
@@ -372,11 +381,11 @@ await client.log
 ```typescript
 const client = new MisoClient({
   ...loadConfig(),
-  emitEvents: true // Enable event emission mode
+  emitEvents: true, // Enable event emission mode
 });
 
 // Listen to log events
-client.log.on('log', (logEntry: LogEntry) => {
+client.log.on("log", (logEntry: LogEntry) => {
   // Save directly to DB without HTTP
   db.saveLog(logEntry);
 });
@@ -393,7 +402,7 @@ client.log.on('log', (logEntry: LogEntry) => {
 **What happens:** Create audit trails for compliance and security monitoring.
 
 ```typescript
-import { MisoClient, loadConfig } from '@aifabrix/miso-client';
+import { MisoClient, loadConfig } from "@aifabrix/miso-client";
 
 // Complete configuration (all in .env)
 const client = new MisoClient(loadConfig());
@@ -401,28 +410,28 @@ await client.initialize();
 
 const token = client.getToken(req);
 const isValid = await client.validateToken(token);
-const canEdit = await client.hasPermission(token, 'edit:content');
+const canEdit = await client.hasPermission(token, "edit:content");
 const user = await client.getUser(token);
 
 // Audit: User actions
-await client.log.audit('user.login', 'authentication', {
+await client.log.audit("user.login", "authentication", {
   userId: user?.id,
   ip: req.ip,
-  userAgent: req.headers['user-agent'],
+  userAgent: req.headers["user-agent"],
 });
 
 // Audit: Content changes
-await client.log.audit('post.created', 'content', {
+await client.log.audit("post.created", "content", {
   userId: user?.id,
-  postId: 'post-123',
+  postId: "post-123",
   postTitle: req.body.title,
 });
 
 // Audit: Permission checks
-await client.log.audit('access.denied', 'authorization', {
+await client.log.audit("access.denied", "authorization", {
   userId: user?.id,
-  requiredPermission: 'edit:content',
-  resource: 'posts',
+  requiredPermission: "edit:content",
+  resource: "posts",
 });
 ```
 
@@ -438,7 +447,7 @@ await client.log.audit('access.denied', 'authorization', {
 **What happens:** All HTTP requests are automatically audited with sensitive data masking for ISO 27001 compliance.
 
 ```typescript
-import { MisoClient, loadConfig } from '@aifabrix/miso-client';
+import { MisoClient, loadConfig } from "@aifabrix/miso-client";
 
 const client = new MisoClient(loadConfig());
 await client.initialize();
@@ -477,10 +486,10 @@ The SDK automatically optimizes audit logging performance:
 const client = new MisoClient({
   ...loadConfig(),
   audit: {
-    level: 'standard', // Light masking, good performance
+    level: "standard", // Light masking, good performance
     batchSize: 20, // Batch 20 logs per request
-    maxResponseSize: 10000 // Truncate large responses
-  }
+    maxResponseSize: 10000, // Truncate large responses
+  },
 });
 ```
 
@@ -511,23 +520,23 @@ const client = new MisoClient({
 **What happens:** Use encryption for sensitive data and generic caching for improved performance.
 
 ```typescript
-import { MisoClient, loadConfig } from '@aifabrix/miso-client';
+import { MisoClient, loadConfig } from "@aifabrix/miso-client";
 
 const client = new MisoClient(loadConfig());
 await client.initialize();
 
 // Encryption (requires ENCRYPTION_KEY in .env or config.encryptionKey)
 if (client.encryption) {
-  const encrypted = client.encryption.encrypt('sensitive-data');
+  const encrypted = client.encryption.encrypt("sensitive-data");
   const decrypted = client.encryption.decrypt(encrypted);
-  console.log('Decrypted:', decrypted);
+  console.log("Decrypted:", decrypted);
 }
 
 // Generic caching (automatically uses Redis if available, falls back to memory)
-await client.cache.set('user:123', { name: 'John', age: 30 }, 600); // 10 minutes TTL
-const user = await client.cache.get<{ name: string; age: number }>('user:123');
+await client.cache.set("user:123", { name: "John", age: 30 }, 600); // 10 minutes TTL
+const user = await client.cache.get<{ name: string; age: number }>("user:123");
 if (user) {
-  console.log('Cached user:', user);
+  console.log("Cached user:", user);
 }
 ```
 
@@ -548,47 +557,50 @@ ENCRYPTION_KEY=your-32-byte-encryption-key
 **What happens:** Use reusable utilities for pagination, filtering, and sorting following enterprise application best practices and industry standards (ISO 27001 compliant).
 
 ```typescript
-import { 
-  FilterBuilder, 
-  parsePaginationParams, 
+import {
+  FilterBuilder,
+  parsePaginationParams,
   parseSortParams,
   buildQueryString,
-  createPaginatedListResponse
-} from '@aifabrix/miso-client';
+  createPaginatedListResponse,
+} from "@aifabrix/miso-client";
 
 const client = new MisoClient(loadConfig());
 await client.initialize();
 
 // Dynamic filter building (FilterBuilder)
 const filterBuilder = new FilterBuilder()
-  .add('status', 'eq', 'active')
-  .add('region', 'in', ['eu', 'us'])
-  .add('created_at', 'gte', '2024-01-01');
+  .add("status", "eq", "active")
+  .add("region", "in", ["eu", "us"])
+  .add("created_at", "gte", "2024-01-01");
 
 const queryString = filterBuilder.toQueryString();
 // Returns: "filter=status:eq:active&filter=region:in:eu,us&filter=created_at:gte:2024-01-01"
 
 // Parse pagination from query string
-const { currentPage, pageSize } = parsePaginationParams({ page: '1', page_size: '25' });
+const { currentPage, pageSize } = parsePaginationParams({
+  page: "1",
+  page_size: "25",
+});
 
 // Parse sort from query string
-const sortOptions = parseSortParams({ sort: '-updated_at' });
+const sortOptions = parseSortParams({ sort: "-updated_at" });
 
 // Build complete query
 const completeQuery = buildQueryString({
   filters: filterBuilder.build(),
-  sort: ['-updated_at'],
+  sort: ["-updated_at"],
   page: currentPage,
-  pageSize: pageSize
+  pageSize: pageSize,
 });
 
 // Create paginated response
 const response = createPaginatedListResponse(
   items,
   120, // totalItems
-  1,   // currentPage
-  25,  // pageSize
-  'application' // type
+  1, // currentPage
+  25, // pageSize
+  "application", // type
 );
 ```
 
@@ -615,14 +627,14 @@ pnpm add @aifabrix/miso-client express
 #### Quick Start
 
 ```typescript
-import express from 'express';
-import { 
+import express from "express";
+import {
   injectResponseHelpers,
   asyncHandler,
   ValidationHelper,
   setErrorLogger,
-  EncryptionUtil
-} from '@aifabrix/miso-client';
+  EncryptionUtil,
+} from "@aifabrix/miso-client";
 
 const app = express();
 
@@ -633,18 +645,21 @@ app.use(injectResponseHelpers);
 setErrorLogger({
   async logError(message, options) {
     console.error(message, options);
-  }
+  },
 });
 
 // Use asyncHandler for automatic error handling
-app.get('/users/:id', asyncHandler(async (req, res) => {
-  const user = await ValidationHelper.findOrFail(
-    () => db.user.findById(req.params.id),
-    'User',
-    req.params.id
-  );
-  res.success(user, 'User retrieved');
-}));
+app.get(
+  "/users/:id",
+  asyncHandler(async (req, res) => {
+    const user = await ValidationHelper.findOrFail(
+      () => db.user.findById(req.params.id),
+      "User",
+      req.params.id,
+    );
+    res.success(user, "User retrieved");
+  }),
+);
 ```
 
 #### Response Helpers
@@ -652,27 +667,27 @@ app.get('/users/:id', asyncHandler(async (req, res) => {
 Standardized API response formatting:
 
 ```typescript
-import { ResponseHelper } from '@aifabrix/miso-client';
+import { ResponseHelper } from "@aifabrix/miso-client";
 
 // Success response (200)
-return ResponseHelper.success(res, data, 'Success message');
+return ResponseHelper.success(res, data, "Success message");
 
 // Created response (201)
-return ResponseHelper.created(res, newResource, 'Resource created');
+return ResponseHelper.created(res, newResource, "Resource created");
 
 // Paginated response
 return ResponseHelper.paginated(res, items, {
   currentPage: 1,
   pageSize: 20,
   totalItems: 100,
-  type: 'user'
+  type: "user",
 });
 
 // No content (204)
 return ResponseHelper.noContent(res);
 
 // Accepted (202)
-return ResponseHelper.accepted(res, { jobId: '123' }, 'Job queued');
+return ResponseHelper.accepted(res, { jobId: "123" }, "Job queued");
 
 // Or use injected methods on res object
 res.success(user);
@@ -687,19 +702,25 @@ res.accepted(data);
 Eliminates try-catch blocks in route handlers:
 
 ```typescript
-import { asyncHandler } from '@aifabrix/miso-client';
+import { asyncHandler } from "@aifabrix/miso-client";
 
 // Automatic error handling
-router.post('/users', asyncHandler(async (req, res) => {
-  const user = await userService.create(req.body);
-  res.created(user, 'User created');
-}));
+router.post(
+  "/users",
+  asyncHandler(async (req, res) => {
+    const user = await userService.create(req.body);
+    res.created(user, "User created");
+  }),
+);
 
 // Named variant for better error messages
-router.get('/users/:id', asyncHandlerNamed('getUser', async (req, res) => {
-  const user = await userService.findById(req.params.id);
-  res.success(user);
-}));
+router.get(
+  "/users/:id",
+  asyncHandlerNamed("getUser", async (req, res) => {
+    const user = await userService.findById(req.params.id);
+    res.success(user);
+  }),
+);
 ```
 
 #### Validation Helper
@@ -707,30 +728,30 @@ router.get('/users/:id', asyncHandlerNamed('getUser', async (req, res) => {
 Common validation patterns:
 
 ```typescript
-import { ValidationHelper } from '@aifabrix/miso-client';
+import { ValidationHelper } from "@aifabrix/miso-client";
 
 // Find or throw 404
 const user = await ValidationHelper.findOrFail(
   () => prisma.user.findUnique({ where: { id } }),
-  'User',
-  id
+  "User",
+  id,
 );
 
 // Ensure doesn't exist or throw 409
 await ValidationHelper.ensureNotExists(
   () => prisma.user.findUnique({ where: { email } }),
-  'User',
-  email
+  "User",
+  email,
 );
 
 // Check ownership or admin role
 ValidationHelper.ensureOwnershipOrAdmin(req, resourceUserId);
 
 // Validate required fields
-ValidationHelper.validateRequiredFields(data, ['name', 'email'], 'User');
+ValidationHelper.validateRequiredFields(data, ["name", "email"], "User");
 
 // Validate string length
-ValidationHelper.validateStringLength(password, 'password', 8, 128);
+ValidationHelper.validateStringLength(password, "password", 8, 128);
 ```
 
 #### Error Handling
@@ -738,13 +759,13 @@ ValidationHelper.validateStringLength(password, 'password', 8, 128);
 RFC 7807 compliant error responses with optional custom logger:
 
 ```typescript
-import { setErrorLogger } from '@aifabrix/miso-client';
+import { setErrorLogger } from "@aifabrix/miso-client";
 
 // Configure during app initialization
 setErrorLogger({
   async logError(message, options) {
     await yourLogger.error(message, options);
-  }
+  },
 });
 
 // Errors are automatically handled by asyncHandler
@@ -756,20 +777,20 @@ setErrorLogger({
 AES-256-GCM encryption for sensitive data:
 
 ```typescript
-import { EncryptionUtil } from '@aifabrix/miso-client';
+import { EncryptionUtil } from "@aifabrix/miso-client";
 
 // Initialize once at startup (uses ENCRYPTION_KEY env var)
 EncryptionUtil.initialize();
 
 // Encrypt sensitive data
-const encrypted = EncryptionUtil.encrypt('sensitive-data');
+const encrypted = EncryptionUtil.encrypt("sensitive-data");
 
 // Decrypt
 const decrypted = EncryptionUtil.decrypt(encrypted);
 
 // Generate new key (for setup)
 const key = EncryptionUtil.generateKey();
-console.log('ENCRYPTION_KEY=' + key);
+console.log("ENCRYPTION_KEY=" + key);
 ```
 
 #### Sort Utilities
@@ -777,21 +798,21 @@ console.log('ENCRYPTION_KEY=' + key);
 Parse and apply sorting for API queries:
 
 ```typescript
-import { parseSortParams, applySorting } from '@aifabrix/miso-client';
+import { parseSortParams, applySorting } from "@aifabrix/miso-client";
 
 // Parse sort query parameters
-const sortOptions = parseSortParams({ sort: ['-createdAt', 'name'] });
+const sortOptions = parseSortParams({ sort: ["-createdAt", "name"] });
 // Returns: [{ field: 'createdAt', order: 'desc' }, { field: 'name', order: 'asc' }]
 
 // Apply sorting to in-memory data (client-side)
 const sortedData = applySorting(users, sortOptions);
 
 // Or parse from Express request query
-app.get('/users', (req, res) => {
+app.get("/users", (req, res) => {
   const sortOptions = parseSortParams(req.query);
   // Use sortOptions to build database query with Prisma/SQL
   const users = await prisma.user.findMany({
-    orderBy: sortOptions.map(s => ({ [s.field]: s.order }))
+    orderBy: sortOptions.map((s) => ({ [s.field]: s.order })),
   });
   res.success(users);
 });
@@ -809,7 +830,7 @@ app.get('/users', (req, res) => {
 **What happens:** Configure flexible authentication methods with priority-based fallback for advanced authentication scenarios.
 
 ```typescript
-import { MisoClient, loadConfig } from '@aifabrix/miso-client';
+import { MisoClient, loadConfig } from "@aifabrix/miso-client";
 
 const client = new MisoClient(loadConfig());
 await client.initialize();
@@ -818,17 +839,21 @@ await client.initialize();
 const client = new MisoClient({
   ...loadConfig(),
   authStrategy: {
-    methods: ['bearer', 'client-token', 'client-credentials']
-  }
+    methods: ["bearer", "client-token", "client-credentials"],
+  },
 });
 
 // Per-request strategy override
-const strategy = client.createAuthStrategy(['bearer', 'api-key'], 'token-123', 'api-key-456');
+const strategy = client.createAuthStrategy(
+  ["bearer", "api-key"],
+  "token-123",
+  "api-key-456",
+);
 await client.getRoles(token, strategy);
 
 // Using requestWithAuthStrategy for custom requests
-await client.requestWithAuthStrategy('GET', '/api/data', {
-  methods: ['client-token']
+await client.requestWithAuthStrategy("GET", "/api/data", {
+  methods: ["client-token"],
 });
 
 // Get default strategy
@@ -863,27 +888,27 @@ MISO_API_KEY=optional-api-key
 
 ```typescript
 interface MisoClientConfig {
-  controllerUrl: string;      // Required: Controller URL
-  clientId: string;           // Required: Client ID (e.g., 'ctrl-dev-my-app')
-  clientSecret: string;       // Required: Client secret
-  redis?: RedisConfig;        // Optional: For caching
-  logLevel?: 'debug' | 'info' | 'warn' | 'error';
-  encryptionKey?: string;     // Optional: Encryption key (or use ENCRYPTION_KEY env var)
+  controllerUrl: string; // Required: Controller URL
+  clientId: string; // Required: Client ID (e.g., 'ctrl-dev-my-app')
+  clientSecret: string; // Required: Client secret
+  redis?: RedisConfig; // Optional: For caching
+  logLevel?: "debug" | "info" | "warn" | "error";
+  encryptionKey?: string; // Optional: Encryption key (or use ENCRYPTION_KEY env var)
   sensitiveFieldsConfig?: string; // Optional: Path to ISO 27001 sensitive fields config JSON
-  emitEvents?: boolean;       // Optional: Emit log events instead of HTTP/Redis (for direct SDK embedding)
+  emitEvents?: boolean; // Optional: Emit log events instead of HTTP/Redis (for direct SDK embedding)
   authStrategy?: AuthStrategy; // Optional: Default authentication strategy
   cache?: {
-    roleTTL?: number;         // Role cache TTL (default: 900s)
-    permissionTTL?: number;   // Permission cache TTL (default: 900s)
+    roleTTL?: number; // Role cache TTL (default: 900s)
+    permissionTTL?: number; // Permission cache TTL (default: 900s)
     tokenValidationTTL?: number; // Token validation cache TTL (default: 900s)
   };
-  audit?: AuditConfig;        // Optional: Audit logging configuration
+  audit?: AuditConfig; // Optional: Audit logging configuration
 }
 
 interface AuthStrategy {
-  methods: ('bearer' | 'client-token' | 'client-credentials' | 'api-key')[];
-  bearerToken?: string;       // Optional: Bearer token for bearer authentication
-  apiKey?: string;            // Optional: API key for api-key authentication
+  methods: ("bearer" | "client-token" | "client-credentials" | "api-key")[];
+  bearerToken?: string; // Optional: Bearer token for bearer authentication
+  apiKey?: string; // Optional: API key for api-key authentication
 }
 ```
 
@@ -972,15 +997,15 @@ app.use(async (req, res, next) => {
 **Protect routes by role:**
 
 ```typescript
-app.get('/admin', async (req, res) => {
+app.get("/admin", async (req, res) => {
   const token = client.getToken(req);
-  if (!token) return res.status(401).json({ error: 'Unauthorized' });
-  
-  const isAdmin = await client.hasRole(token, 'admin');
-  if (!isAdmin) return res.status(403).json({ error: 'Forbidden' });
-  
+  if (!token) return res.status(401).json({ error: "Unauthorized" });
+
+  const isAdmin = await client.hasRole(token, "admin");
+  if (!isAdmin) return res.status(403).json({ error: "Forbidden" });
+
   // Admin only code
-  res.json({ message: 'Admin panel' });
+  res.json({ message: "Admin panel" });
 });
 ```