feat(auth): middleware Nitro serveur — pose event.context.userId (THI-134)

[Tbeaumont79]

Pourquoi

Constaté en branchant le metering (THI-133) : aucun middleware Nitro côté serveur ne résolvait la session. requireUserId(event) renvoyait donc 401 pour toutes les routes authentifiées (GET /api/usage/current, et bientôt export-pdf + génération). Le seul apps/app/middleware/auth.ts existant est un route-guard Nuxt client.

Ce que fait cette PR

• apps/app/server/middleware/auth.ts — résout la session Better Auth (auth.api.getSession({ headers: event.headers })) et pose event.context.userId. Non bloquant : si pas de session, userId reste indéfini (pas de 401 ici) — chaque route décide via requireUserId. Ce middleware est le producteur de event.context.userId ; requireUserId (session.ts, lot metering) en est le consommateur.
• apps/app/server/utils/auth-context.ts — resolveUserId(), logique pure et injectable, suivant la convention DI du repo (cf. health.ts / pingDb), pour rester testable sans charger better-auth.
• apps/app/test/auth-context.spec.ts — 5 tests unitaires.

Vérification

vitest run test/auth-context.spec.ts → 5/5 verts (session présente → id ; pas de session / user nul / id nul → undefined sans lever ; en-têtes bien transmis).

Le typecheck complet et le DoD end-to-end (GET /api/usage/current → 200 authentifié / 401 sinon) nécessitent les deux PR dépendantes ci-dessous (l'instance auth et session.ts//api/usage/current n'existent pas encore sur main).

Ordre de merge (important)

À merger après :

1. feat(auth): Better Auth magic-link + tables satellites (THI-131, slice 2/3) #8 feat(auth): Better Auth magic-link (THI-131) — fournit l'instance auth.
2. feat(metering): service + endpoint usage courant (THI-126 — 2/2) #12 feat(metering): service + endpoint usage courant (THI-126/THI-133) — fournit requireUserId et GET /api/usage/current.

Une fois ces deux PR mergées, le DoD de THI-134 est satisfait. La déclaration H3EventContext.userId? est dupliquée à l'identique côté lecteur (session.ts) et côté producteur (ce middleware) : les déclarations d'interface identiques fusionnent, aucune collision au merge.

Rattaché à l'auth (THI-131). Débloque le metering (THI-133).

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Implemented server-side authentication session handling that automatically resolves and maintains user identity across requests, enabling secure context throughout the application lifecycle.

• Tests

  • Added comprehensive test coverage for authentication session resolution, validating behavior across various session states and conditions.

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Free

Run ID: f6caa907-75df-4660-a0ff-2d2181bf5a46

📥 Commits

Reviewing files that changed from the base of the PR and between de0a541 and 73b8415.

📒 Files selected for processing (3)

• apps/app/server/middleware/auth.ts
• apps/app/server/utils/auth-context.ts
• apps/app/test/auth-context.spec.ts

---

📝 Walkthrough

Walkthrough

This PR establishes server-side authentication infrastructure by introducing a session resolution utility, comprehensive tests, and middleware that extracts the authenticated user id from Better Auth and makes it available via the request context. Missing sessions or users are handled gracefully without blocking requests.

Changes

Auth Session Resolution

Layer / File(s)	Summary
Session resolution utility apps/app/server/utils/auth-context.ts	SessionLike interface and SessionResolver type define the contract for session resolution. resolveUserId function safely extracts session.user.id or returns undefined when session or user is missing.
Session resolution tests apps/app/test/auth-context.spec.ts	Vitest suite covers successful user id extraction, graceful handling of absent session/user/null id, and verification that request Headers are forwarded unchanged to the resolver.
Server middleware integration apps/app/server/middleware/auth.ts	Event handler resolves Better Auth session and populates event.context.userId; module augmentation extends h3's H3EventContext to declare userId?: string for type safety downstream.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 A session slips through headers and headers,
Resolved with care, not swift endeavors,
No user means we skip, don't cry,
Context waits for userId,
Auth flows now with tested fevors! 🔐

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}