@podosoft/podokit 1.1.6 → 1.2.0

package/dist/templates/modules/object-storage-local/files/apps/api/src/storage-local/storage-local.module.ts

@@ -1,60 +1,137 @@
+import { AppException } from "@podosoft/podokit-contracts";
 import {
   LocalObjectStore,
   OBJECT_STORAGE,
+  objectResponse,
   type ObjectData,
+  type ObjectStore,
 } from "@podosoft/podokit-runtime";
 import { Elysia, t } from "elysia";
-import { resolve } from "node:path";
-import type { AppPlugin, PodokitModule } from "../core/services";
+import { join, resolve } from "node:path";
+import {
+  ACCESS_POLICY,
+  REQUEST_IDENTITY,
+  type AppPlugin,
+  type ElysiaPlugin,
+  type PodokitModule,
+  type RequestIdentity,
+  type ServiceKey,
+} from "../core/services";
 import { PROVIDERS } from "../config/providers";
+import { DownloadUrlSigner, objectKeyFromPath, SignedDownloadStore } from "./download-url";
+import {
+  demoKeyParams,
+  demoObjectKey,
+  requireStorageAdmin,
+  storageObjectNotFound,
+} from "./storage-demo";
+
+export const DOWNLOAD_BASE_URL = "/files/content";
+export const LOCAL_DOWNLOAD_URLS = Symbol("local-download-urls") as ServiceKey<DownloadUrlSigner>;
 
-function responseBody(object: ObjectData): ReadableStream<Uint8Array> {
-  const iterator = object.body[Symbol.asyncIterator]();
-  return new ReadableStream<Uint8Array>({
-    async pull(controller): Promise<void> {
-      const next = await iterator.next();
-      if (next.done) controller.close();
-      else controller.enqueue(next.value);
-    },
-    async cancel(): Promise<void> {
-      await iterator.return?.();
-    },
-  });
+async function readObject(storage: ObjectStore, key: string): Promise<ObjectData> {
+  const object = await storage.get(key);
+  if (!object) throw storageObjectNotFound();
+  return object;
 }
 
-const localStoragePlugin: AppPlugin = ({ services }) => {
-  if (PROVIDERS["object-storage"] !== "local") {
-    return new Elysia({ name: "podokit.storage-local.inactive" });
-  }
-  const storage = services.resolve(OBJECT_STORAGE);
+// Local objects are served from the app's own origin with the type the uploader
+// declared. Only render types that cannot run script; everything else downloads,
+// and the sandbox policy blocks script even if a browser renders it anyway.
+const INLINE_CONTENT_TYPES = new Set([
+  "image/png",
+  "image/jpeg",
+  "image/gif",
+  "image/webp",
+  "image/avif",
+  "text/plain",
+]);
+
+export function downloadSafetyHeaders(contentType: string | undefined): Record<string, string> {
+  const mediaType = contentType?.split(";")[0]?.trim().toLowerCase() ?? "";
+  return {
+    "x-content-type-options": "nosniff",
+    "content-security-policy": "default-src 'none'; sandbox",
+    "content-disposition": INLINE_CONTENT_TYPES.has(mediaType) ? "inline" : "attachment",
+  };
+}
+
+export function localStorageRoutes(
+  storage: ObjectStore,
+  signer: DownloadUrlSigner,
+  identity: RequestIdentity,
+): ElysiaPlugin {
   return new Elysia({ name: "podokit.storage-local" })
-    .get("/files/content/*", async ({ params, set }) => {
-      const object = await storage.get(params["*"]);
-      if (object.contentType) set.headers["content-type"] = object.contentType;
-      set.headers["content-length"] = String(object.size);
-      return new Response(responseBody(object));
+    .get("/files/content/*", async ({ request, params, query }) => {
+      const key = objectKeyFromPath(params["*"]);
+      if (key === undefined || !(await signer.verify(key, query.expires, query.signature))) {
+        throw new AppException(
+          "DOWNLOAD_URL_INVALID",
+          "The download URL is invalid or has expired",
+          403,
+        );
+      }
+      const object = await readObject(storage, key);
+      return objectResponse(request, object, { headers: downloadSafetyHeaders(object.contentType) });
     }, {
-      detail: { tags: ["files"], summary: "Read a local object" },
+      query: t.Object({
+        expires: t.Optional(t.String()),
+        signature: t.Optional(t.String()),
+      }),
+      detail: { tags: ["files"], summary: "Read a local object through a signed download URL" },
     })
-    .put("/storage/:key", async ({ params, body }) => {
-      await storage.put(params.key, body.content, { contentType: "text/plain" });
+    .put("/storage/:key", async ({ request, params, body }) => {
+      await requireStorageAdmin(identity, request);
+      await storage.put(demoObjectKey(params.key), body.content, { contentType: "text/plain" });
       return { key: params.key };
     }, {
-      params: t.Object({ key: t.String({ minLength: 1 }) }),
+      params: demoKeyParams,
       body: t.Object({ content: t.String() }),
-      detail: { tags: ["storage"], summary: "Store an object" },
+      detail: { tags: ["storage"], summary: "Store a demo object (administrators only)" },
+    })
+    .get("/storage/:key/presigned", async ({ request, params }) => {
+      await requireStorageAdmin(identity, request);
+      return { url: await storage.getDownloadUrl(demoObjectKey(params.key)) };
+    }, {
+      params: demoKeyParams,
+      detail: { tags: ["storage"], summary: "Sign a demo object download URL (administrators only)" },
+    })
+    .get("/storage/:key", async ({ request, params }) => {
+      await requireStorageAdmin(identity, request);
+      const object = await readObject(storage, demoObjectKey(params.key));
+      return objectResponse(request, object, { headers: downloadSafetyHeaders(object.contentType) });
+    }, {
+      params: demoKeyParams,
+      detail: { tags: ["storage"], summary: "Read a demo object (administrators only)" },
     });
+}
+
+const localStoragePlugin: AppPlugin = ({ services }) => {
+  if (PROVIDERS["object-storage"] !== "local") {
+    return new Elysia({ name: "podokit.storage-local.inactive" });
+  }
+  return localStorageRoutes(
+    services.resolve(OBJECT_STORAGE),
+    services.resolve(LOCAL_DOWNLOAD_URLS),
+    services.resolve(REQUEST_IDENTITY),
+  );
 };
 
 export const storageLocalModule: PodokitModule = {
   name: "object-storage-local",
   configure: (_env, services): void => {
     if (PROVIDERS["object-storage"] !== "local") return;
-    const storage = new LocalObjectStore({
-      rootDirectory: resolve(process.env.LOCAL_STORAGE_PATH ?? "./data/files"),
-      publicBaseUrl: "/files/content",
-    });
+    const root = resolve(process.env.LOCAL_STORAGE_PATH ?? "./data/files");
+    const signer = new DownloadUrlSigner(join(root, ".podokit", "download-url.key"));
+    const storage = new SignedDownloadStore(
+      new LocalObjectStore({ rootDirectory: root, publicBaseUrl: DOWNLOAD_BASE_URL }),
+      signer,
+      DOWNLOAD_BASE_URL,
+    );
     services.register(OBJECT_STORAGE, storage, () => storage.close());
+    services.register(LOCAL_DOWNLOAD_URLS, signer);
+    // The signature is the authorization, as with an S3 presigned URL.
+    services.resolve(ACCESS_POLICY).register("GET", `${DOWNLOAD_BASE_URL}/*`, "public");
   },
   plugin: localStoragePlugin,
 };

package/dist/templates/modules/object-storage-local/files/tests/api/storage-local.api.spec.ts

@@ -0,0 +1,88 @@
+import { expect, test, type APIRequestContext, type PlaywrightWorkerArgs } from "@playwright/test";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+// The administrator seeded by the admin-dashboard Playwright setup. Inlined so this
+// spec also compiles in apps that do not install that module.
+const admin = {
+  email: "admin@example.com",
+  password: process.env.E2E_ADMIN_PASSWORD || "Podokit3e-Str0ng!pw",
+};
+
+type Playwright = PlaywrightWorkerArgs["playwright"];
+
+function uniqueKey(): string {
+  return `local-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+}
+
+function newContext(playwright: Playwright): Promise<APIRequestContext> {
+  return playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+}
+
+async function sessionRoles(ctx: APIRequestContext): Promise<string[] | undefined> {
+  const response = await ctx.get("/api/auth/get-session");
+  if (!response.ok()) return undefined;
+  const session = await response.json() as { user?: { role?: string | null } } | null;
+  if (!session?.user) return undefined;
+  return (session.user.role ?? "").split(",").map((role) => role.trim()).filter(Boolean);
+}
+
+/** Resolves false when the auth module is missing or sign-up does not start a session. */
+async function signUp(ctx: APIRequestContext): Promise<boolean> {
+  const email = `storage-local-${Date.now()}-${Math.random().toString(36).slice(2, 8)}@example.com`;
+  await ctx.post("/api/auth/sign-up/email", { data: { email, password: "Podokit3e-Str0ng!pw", name: "L" } });
+  return (await sessionRoles(ctx)) !== undefined;
+}
+
+/** Resolves false when no administrator session is available. */
+async function signInAdmin(ctx: APIRequestContext): Promise<boolean> {
+  const response = await ctx.post("/api/auth/sign-in/email", { data: admin });
+  return response.ok() && ((await sessionRoles(ctx)) ?? []).includes("admin");
+}
+
+test("local storage: signed download URLs reach only the signed object", async ({ playwright }) => {
+  const ctx = await newContext(playwright);
+  const anonymous = await newContext(playwright);
+  const key = uniqueKey();
+  try {
+    test.skip(!(await signInAdmin(ctx)), "requires the auth module and the seeded administrator");
+    const presigned = await ctx.get(`/api/storage/${key}/presigned`);
+    const { url } = await presigned.json() as { url?: string };
+    test.skip(!url?.startsWith("/files/content/"), "object-storage provider is not local");
+    if (!url) throw new Error("presign response must include a url");
+    expect(url).toContain(`/files/content/demo/${key}?`);
+    expect((await ctx.put(`/api/storage/${key}`, { data: { content: "hello local" } })).ok()).toBeTruthy();
+
+    const download = await anonymous.get(`/api${url}`);
+    expect(download.ok()).toBeTruthy();
+    expect(await download.text()).toBe("hello local");
+
+    const unsigned = await anonymous.get(`/api${url.split("?")[0]}`);
+    expect(unsigned.status()).toBe(403);
+    expect(await unsigned.json()).toMatchObject({ error: { code: "DOWNLOAD_URL_INVALID" } });
+
+    const altered = await anonymous.get(`/api${url.replace(`demo/${key}`, `demo/${key}-other`)}`);
+    expect(altered.status()).toBe(403);
+  } finally {
+    await ctx.dispose();
+    await anonymous.dispose();
+  }
+});
+
+test("local storage demo routes are limited to administrators", async ({ playwright }) => {
+  const user = await newContext(playwright);
+  const key = uniqueKey();
+  try {
+    test.skip(!(await signUp(user)), "requires the auth module");
+    for (const response of [
+      await user.put(`/api/storage/${key}`, { data: { content: "x" } }),
+      await user.get(`/api/storage/${key}`),
+      await user.get(`/api/storage/${key}/presigned`),
+    ]) {
+      expect(response.status()).toBe(403);
+      expect(await response.json()).toMatchObject({ error: { code: "ADMIN_REQUIRED" } });
+    }
+  } finally {
+    await user.dispose();
+  }
+});

package/dist/templates/modules/object-storage-local/module.manifest.json

@@ -7,6 +7,9 @@
   "requiredProjectFiles": [
     "apps/api/src/config/providers.ts"
   ],
+  "requiredProjectContents": {
+    "apps/api/src/core/services.ts": ["isAdmin(request: Request): Promise<boolean>;"]
+  },
   "managedGlobs": [
     "apps/api/src/storage-local/**"
   ],
@@ -29,6 +32,8 @@
   ],
   "instructions": [
     "Local object storage is single-host. Back up LOCAL_STORAGE_PATH together with the database.",
-    "Keep the API at one replica or select the S3 provider."
+    "Keep the API at one replica or select the S3 provider.",
+    "Download URLs are signed and expire after one hour by default. The signing key lives in LOCAL_STORAGE_PATH/.podokit/download-url.key; deleting it invalidates every issued URL.",
+    "The /storage demo routes need the auth module and an administrator session, and only reach keys under demo/."
   ]
 }

package/dist/templates/modules/object-storage-s3/files/apps/api/src/storage/s3-object.store.spec.ts

@@ -0,0 +1,80 @@
+import { afterAll, describe, expect, it } from "bun:test";
+import { randomBytes, randomUUID } from "node:crypto";
+import { ReadinessService } from "../health/readiness.service";
+import { S3ObjectStore } from "./s3-object.store";
+import { StorageService } from "./storage.service";
+
+// Runs against the bucket in the S3_* settings, like the storage API spec.
+const integration = process.env.S3_ENDPOINT ? describe : describe.skip;
+
+integration("S3ObjectStore against a live bucket", () => {
+  const storage = new StorageService(new ReadinessService());
+  const store = new S3ObjectStore(storage);
+  const prefix = `podokit-test/${randomUUID()}/`;
+  const created: string[] = [];
+
+  async function put(name: string, content: Uint8Array | string, contentType?: string): Promise<string> {
+    const key = `${prefix}${name}`;
+    created.push(key);
+    await store.put(key, content, contentType ? { contentType } : {});
+    return key;
+  }
+
+  afterAll(async () => {
+    await Promise.all(created.map((key) => storage.delete(key)));
+    storage.close();
+  });
+
+  it("describes an object and streams exactly its content", async () => {
+    const content = randomBytes(3 * 1024 * 1024);
+    const key = await put("object.bin", content, "application/octet-stream");
+
+    const info = await store.stat(key);
+    expect(info).toMatchObject({ key, size: content.byteLength, contentType: "application/octet-stream" });
+    expect(info?.etag).toMatch(/^"[^"]+"$/);
+    expect(info?.lastModified).toBeInstanceOf(Date);
+
+    const object = await store.get(key);
+    if (!object) throw new Error("expected the stored object");
+    expect(object.etag).toBe(info?.etag ?? "");
+    const streamed = Buffer.from(await new Response(object.body).arrayBuffer());
+    expect(streamed.equals(content)).toBe(true);
+  });
+
+  it("lists keys a page at a time", async () => {
+    const names = ["list/a.txt", "list/b.txt", "list/c/d.txt", "list/e.txt", "listed.txt"];
+    for (const name of names) await put(name, name);
+
+    const pages: string[][] = [];
+    let cursor: string | undefined;
+    do {
+      const page = await store.list(`${prefix}list/`, { limit: 2, ...(cursor ? { cursor } : {}) });
+      pages.push(page.keys.map((key) => key.slice(prefix.length)));
+      cursor = page.nextCursor;
+    } while (cursor !== undefined);
+
+    expect(pages).toEqual([["list/a.txt", "list/b.txt"], ["list/c/d.txt", "list/e.txt"]]);
+    expect((await store.list(`${prefix}list`)).keys).toHaveLength(names.length);
+    await expect(store.list(prefix, { limit: 0 })).rejects.toThrow("from 1 to 1000");
+  });
+
+  it("reports a missing key as null and lets an unread body be dropped", async () => {
+    expect(await store.get(`${prefix}missing`)).toBeNull();
+    expect(await store.stat(`${prefix}missing`)).toBeNull();
+
+    const key = await put("unread.txt", "unread", "text/plain");
+    const object = await store.get(key);
+    if (!object) throw new Error("expected the stored object");
+    await object.body.cancel();
+    expect(object.size).toBe(6);
+  });
+
+  it("fails the stream rather than mix in content written after the metadata was read", async () => {
+    const key = await put("replaced.txt", "before", "text/plain");
+    const object = await store.get(key);
+    if (!object) throw new Error("expected the stored object");
+    await store.put(key, "after!", { contentType: "text/plain" });
+
+    await expect(new Response(object.body).text()).rejects.toThrow("changed while it was being read");
+  });
+});

package/dist/templates/modules/object-storage-s3/files/apps/api/src/storage/s3-object.store.ts

@@ -1,7 +1,10 @@
 import type {
   DownloadUrlOptions,
+  ListObjectsOptions,
   ObjectBody,
   ObjectData,
+  ObjectInfo,
+  ObjectPage,
   ObjectStore,
   PutObjectOptions,
   StoredObject,
@@ -16,10 +19,6 @@ async function bodyBytes(body: ObjectBody): Promise<Uint8Array> {
   return Buffer.concat(chunks);
 }
 
-async function* oneChunk(body: Uint8Array): AsyncGenerator<Uint8Array> {
-  yield body;
-}
-
 export class S3ObjectStore implements ObjectStore {
   constructor(private readonly storage: StorageService) {}
 
@@ -29,9 +28,16 @@ export class S3ObjectStore implements ObjectStore {
     return { key, size: bytes.byteLength, ...options };
   }
 
-  async get(key: string): Promise<ObjectData> {
-    const bytes = await this.storage.get(key);
-    return { key, size: bytes.byteLength, body: oneChunk(bytes) };
+  get(key: string): Promise<ObjectData | null> {
+    return this.storage.open(key);
+  }
+
+  stat(key: string): Promise<ObjectInfo | null> {
+    return this.storage.stat(key);
+  }
+
+  list(prefix: string, options?: ListObjectsOptions): Promise<ObjectPage> {
+    return this.storage.list(prefix, options);
   }
 
   exists(key: string): Promise<boolean> {

package/dist/templates/modules/object-storage-s3/files/apps/api/src/storage/storage-demo.spec.ts

@@ -0,0 +1,156 @@
+import { describe, expect, it } from "bun:test";
+import { AppException } from "@podosoft/podokit-contracts";
+import { Elysia } from "elysia";
+import type { RequestIdentity } from "../core/services";
+import { storageDemoRoutes, type DemoStorage } from "./storage.module";
+
+interface MemoryStorage extends DemoStorage {
+  objects: Map<string, string>;
+  presigned: string[];
+}
+
+function memoryStorage(): MemoryStorage {
+  const objects = new Map<string, string>();
+  const presigned: string[] = [];
+  return {
+    objects,
+    presigned,
+    put: async (key, body) => {
+      if (typeof body === "string") objects.set(key, body);
+      else if (body instanceof Blob) objects.set(key, await body.text());
+      else objects.set(key, Buffer.from(body).toString("utf8"));
+    },
+    open: async (key) => {
+      const content = objects.get(key);
+      if (content === undefined) return null;
+      const bytes = Buffer.from(content);
+      return {
+        key,
+        size: bytes.byteLength,
+        contentType: "text/plain",
+        etag: `"${bytes.toString("hex")}"`,
+        lastModified: new Date("2026-01-02T03:04:05Z"),
+        body: new Blob([bytes]).stream(),
+      };
+    },
+    presignedGetUrl: async (key) => {
+      presigned.push(key);
+      return `https://storage.example.com/${key}?signature=test`;
+    },
+  };
+}
+
+function caller(userId: string | undefined, admin = false): RequestIdentity {
+  return {
+    userId: async () => userId,
+    isAdmin: async () => admin,
+    roles: async () => (admin ? ["admin"] : []),
+    activeOrganizationId: async () => undefined,
+  };
+}
+
+async function call(
+  storage: DemoStorage,
+  identity: RequestIdentity,
+  method: "GET" | "PUT",
+  path: string,
+  options: { content?: string; headers?: Record<string, string> } = {},
+): Promise<Response> {
+  const app = new Elysia()
+    .onError(({ code, error, set }) => {
+      if (error instanceof AppException) {
+        set.status = error.statusCode;
+        return { code: error.code };
+      }
+      if (code === "VALIDATION") {
+        set.status = 400;
+        return { code: "VALIDATION_ERROR" };
+      }
+      if (code === "NOT_FOUND") {
+        set.status = 404;
+        return { code: "NOT_FOUND" };
+      }
+      return undefined;
+    })
+    .use(storageDemoRoutes(storage, identity));
+  return app.handle(new Request(`http://localhost${path}`, {
+    method,
+    headers: {
+      ...(options.content === undefined ? {} : { "content-type": "application/json" }),
+      ...options.headers,
+    },
+    ...(options.content === undefined ? {} : { body: JSON.stringify({ content: options.content }) }),
+  }));
+}
+
+async function reply(response: Promise<Response>): Promise<{ status: number; body: unknown }> {
+  const resolved = await response;
+  return { status: resolved.status, body: await resolved.json() };
+}
+
+describe("object storage demo routes", () => {
+  it("require a signed-in administrator", async () => {
+    const storage = memoryStorage();
+
+    expect(await reply(call(storage, caller(undefined), "PUT", "/storage/hello", { content: "x" }))).toEqual({
+      status: 401,
+      body: { code: "AUTH_REQUIRED" },
+    });
+    for (const [method, path] of [
+      ["PUT", "/storage/hello"],
+      ["GET", "/storage/hello"],
+      ["GET", "/storage/hello/presigned"],
+    ] as const) {
+      const response = call(storage, caller("user-1"), method, path, method === "PUT" ? { content: "x" } : {});
+      expect(await reply(response)).toEqual({ status: 403, body: { code: "ADMIN_REQUIRED" } });
+    }
+    expect(storage.objects.size).toBe(0);
+    expect(storage.presigned).toEqual([]);
+  });
+
+  it("stores, streams, and presigns objects under the demo prefix for administrators", async () => {
+    const storage = memoryStorage();
+    const admin = caller("admin-1", true);
+
+    expect(await reply(call(storage, admin, "PUT", "/storage/hello", { content: "hi" }))).toEqual({
+      status: 200,
+      body: { key: "hello" },
+    });
+    expect([...storage.objects.keys()]).toEqual(["demo/hello"]);
+
+    const read = await call(storage, admin, "GET", "/storage/hello");
+    expect(read.status).toBe(200);
+    expect(read.headers.get("content-type")).toBe("text/plain");
+    expect(read.headers.get("content-length")).toBe("2");
+    expect(read.headers.get("x-content-type-options")).toBe("nosniff");
+    const etag = read.headers.get("etag");
+    expect(etag).toBe("\"6869\"");
+    expect(await read.text()).toBe("hi");
+
+    const revalidated = await call(storage, admin, "GET", "/storage/hello", {
+      headers: { "if-none-match": etag ?? "" },
+    });
+    expect(revalidated.status).toBe(304);
+    expect(await revalidated.text()).toBe("");
+
+    const presigned = await call(storage, admin, "GET", "/storage/hello/presigned");
+    expect(presigned.status).toBe(200);
+    expect(storage.presigned).toEqual(["demo/hello"]);
+  });
+
+  it("reports a missing demo object as not found", async () => {
+    const response = call(memoryStorage(), caller("admin-1", true), "GET", "/storage/missing");
+    expect(await reply(response)).toEqual({ status: 404, body: { code: "STORAGE_OBJECT_NOT_FOUND" } });
+  });
+
+  it("rejects keys that would leave the demo prefix", async () => {
+    const storage = memoryStorage();
+    const admin = caller("admin-1", true);
+
+    for (const key of ["site%2Ffavicon", "profile-images%2Fa.png", "..%2Fsite%2Ffavicon", ".podokit", "%2E%2E"]) {
+      const response = await call(storage, admin, "PUT", `/storage/${key}`, { content: "x" });
+      expect([400, 404]).toContain(response.status);
+    }
+    expect(storage.objects.size).toBe(0);
+  });
+});

package/dist/templates/modules/object-storage-s3/files/apps/api/src/storage/storage-demo.ts

@@ -0,0 +1,38 @@
+import { AppException } from "@podosoft/podokit-contracts";
+import { t } from "elysia";
+import type { RequestIdentity } from "../core/services";
+
+/**
+ * The demo routes only reach objects under this prefix, so even an
+ * administrator cannot overwrite keys owned by other features such as
+ * uploads, profile images, or the site favicon.
+ */
+export const DEMO_KEY_PREFIX = "demo/";
+
+/**
+ * One path segment. Elysia decodes `%2F` inside `:key`, so the pattern rejects
+ * slashes and leading dots instead of trusting the router.
+ */
+export const demoKeyParams = t.Object({
+  key: t.String({ pattern: "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" }),
+});
+
+export function demoObjectKey(name: string): string {
+  return `${DEMO_KEY_PREFIX}${name}`;
+}
+
+export function storageObjectNotFound(): AppException {
+  return new AppException("STORAGE_OBJECT_NOT_FOUND", "Object not found", 404);
+}
+
+export async function requireStorageAdmin(
+  identity: RequestIdentity,
+  request: Request,
+): Promise<void> {
+  if (!(await identity.userId(request))) {
+    throw new AppException("AUTH_REQUIRED", "Authentication is required", 401);
+  }
+  if (!(await identity.isAdmin(request))) {
+    throw new AppException("ADMIN_REQUIRED", "Administrator access is required", 403);
+  }
+}