From 5ef747c2ed0a7e97998c2d425c887c3c6e0e083e Mon Sep 17 00:00:00 2001
From: rhit-steineig <116207222+rhit-steineig@users.noreply.github.com>
Date: Wed, 29 Apr 2026 15:42:43 -0400
Subject: [PATCH 1/4] reduced permission level checking duplication

---
 src/lib/components/Dialog.svelte          |  4 +--
 src/lib/components/ItemCardOptions.svelte | 14 +++-------
 src/lib/components/ItemDetails.svelte     |  8 +++---
 src/lib/components/Menu.svelte            |  4 +--
 src/lib/components/TemplateList.svelte    |  4 +--
 src/lib/components/UserList.svelte        |  7 ++---
 src/lib/stores/loginStore.ts              | 34 +++++++++++++++++------
 src/routes/+page.svelte                   | 10 ++-----
 src/routes/view/[id]/+page.svelte         |  8 ++----
 src/routes/viewTemplates/+page.svelte     | 10 ++-----
 10 files changed, 48 insertions(+), 55 deletions(-)

diff --git a/src/lib/components/Dialog.svelte b/src/lib/components/Dialog.svelte
index 3a55eb99..1a461e71 100644
--- a/src/lib/components/Dialog.svelte
+++ b/src/lib/components/Dialog.svelte
@@ -17,8 +17,8 @@
 		create?: any;
 		// eslint-disable-next-line @typescript-eslint/no-explicit-any
 		children: any;
-		canOverflow: boolean;
-		requireCloseConfirmation: boolean;
+		canOverflow?: boolean;
+		requireCloseConfirmation?: boolean;
 	} = $props();
 
 	let isConfirmationOpen = $state(false);
diff --git a/src/lib/components/ItemCardOptions.svelte b/src/lib/components/ItemCardOptions.svelte
index fa991759..51137f7d 100644
--- a/src/lib/components/ItemCardOptions.svelte
+++ b/src/lib/components/ItemCardOptions.svelte
@@ -1,8 +1,8 @@
 <script lang="ts">
 	import type { IBasicItemPopulated } from "$lib/server/db/models/basicItem.js";
+	import { permissionsAllowEdit } from "$lib/stores/loginStore.js";
 	import { CopyIcon, SquarePenIcon } from "@lucide/svelte";
 	import { createEventDispatcher } from "svelte";
-	import { getEditOnLogin, login } from "../stores/loginStore.js";
 	import CreateItem from "./CreateItem.svelte";
 	import Duplicate from "./Duplicate.svelte";
 
@@ -19,20 +19,14 @@
 	let unique = $state({});
 
 	function duplicateFunction(item: IBasicItemPopulated) {
-		if (
-			!getEditOnLogin() ||
-			($login?.isLoggedIn && $login?.permissionLevel > 1)
-		) {
+		if (permissionsAllowEdit(2)) {
 			duplicator?.changeItem(item);
 			duplicateDialog?.showModal();
 		}
 	}
 
 	function duplicateEditFunction(item: IBasicItemPopulated) {
-		if (
-			!getEditOnLogin() ||
-			($login?.isLoggedIn && $login?.permissionLevel > 1)
-		) {
+		if (permissionsAllowEdit(2)) {
 			creator?.changeItem(item);
 			createDialog?.showModal();
 		}
@@ -48,7 +42,7 @@
 </script>
 
 <div class="simple-flex">
-	{#if !getEditOnLogin() || ($login?.isLoggedIn && $login?.permissionLevel > 1)}
+	{#if permissionsAllowEdit(2)}
 		<!--Duplicate button-->
 		<button
 			class="border-button hoverable"
diff --git a/src/lib/components/ItemDetails.svelte b/src/lib/components/ItemDetails.svelte
index 2840640a..f9b39f60 100644
--- a/src/lib/components/ItemDetails.svelte
+++ b/src/lib/components/ItemDetails.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
 	import type { IBasicItemPopulated } from "$lib/server/db/models/basicItem.js";
-	import { getEditOnLogin, login } from "$lib/stores/loginStore.js";
+	import { currentPermissionLevelIsAtLeast, permissionsAllowEdit } from "$lib/stores/loginStore.js";
 	import {
 		FolderTreeIcon,
 		HouseIcon,
@@ -229,7 +229,7 @@
 	</h1>
 
 	<div class="button-row-flex">
-		{#if !getEditOnLogin() || ($login?.isLoggedIn && $login?.permissionLevel > 0)}
+		{#if permissionsAllowEdit(1)}
 			<button
 				title="Move"
 				class="border-button center-button-icons flex-grow font-semibold shadow"
@@ -244,7 +244,7 @@
 				<HouseIcon class="icon-small" />
 			</button>
 
-			{#if !getEditOnLogin() || ($login?.isLoggedIn && $login?.permissionLevel > 1)}
+			{#if permissionsAllowEdit(2)}
 				<button
 					title="Edit"
 					class="border-button center-button-icons flex-grow font-semibold shadow"
@@ -262,7 +262,7 @@
 				</button>
 			{/if}
 
-			{#if ($login?.permissionLevel ?? 1) > 2}
+			{#if currentPermissionLevelIsAtLeast(3)}
 				<button
 					title="Delete"
 					class="warn-button center-button-icons flex-grow font-semibold shadow"
diff --git a/src/lib/components/Menu.svelte b/src/lib/components/Menu.svelte
index 6de65974..63bb7b22 100644
--- a/src/lib/components/Menu.svelte
+++ b/src/lib/components/Menu.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
 	import { browser } from "$app/environment";
 	import OAuth from "$lib/components/OAuth.svelte";
-	import { login } from "$lib/stores/loginStore.js";
+	import { currentPermissionLevel } from "$lib/stores/loginStore.js";
 	import "$lib/styles/main.css";
 
 	let {
@@ -35,7 +35,7 @@
 		}
 	});
 
-	const permissionLevel = $derived($login?.permissionLevel ?? 0);
+	const permissionLevel = $derived(currentPermissionLevel());
 </script>
 
 {#if open}
diff --git a/src/lib/components/TemplateList.svelte b/src/lib/components/TemplateList.svelte
index 38f1e7fb..656f6018 100644
--- a/src/lib/components/TemplateList.svelte
+++ b/src/lib/components/TemplateList.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
 	import type { ITemplatePopulated } from "$lib/server/db/models/template.js";
-	import { getEditOnLogin, login } from "../stores/loginStore.js";
+	import { permissionsAllowEdit } from "$lib/stores/loginStore.js";
 	import DeleteTemplate from "./DeleteTemplate.svelte";
 	import Dialog from "./Dialog.svelte";
 	import EditTemplate from "./EditTemplate.svelte";
@@ -50,7 +50,7 @@
 				</ul>
 			</div>
 
-			{#if !getEditOnLogin() || ($login?.isLoggedIn && $login?.permissionLevel > 2)}
+			{#if permissionsAllowEdit(3)}
 				<DeleteTemplate
 					templateId={template._id.toString()}
 					onDelete={handleDelete}>
diff --git a/src/lib/components/UserList.svelte b/src/lib/components/UserList.svelte
index a474d153..f822581f 100644
--- a/src/lib/components/UserList.svelte
+++ b/src/lib/components/UserList.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { getEditOnLogin, login, toggleEditOnLogin } from '$lib/stores/loginStore.js';
+	import { getCanOnlyEditWhenLoggedIn, login, setCanOnlyEditWhenLoggedIn } from '$lib/stores/loginStore.js';
 
 	interface User {
 		id: string;
@@ -125,8 +125,7 @@
 	}
 
 	function toggleUserEditOnLogin() {
-		const current = getEditOnLogin();
-		toggleEditOnLogin(!current);
+		setCanOnlyEditWhenLoggedIn(!getCanOnlyEditWhenLoggedIn());
 	}
 </script>
 
@@ -144,7 +143,7 @@
 				type="checkbox" 
 				id="toggle-slider" 
 				class="sr-only peer"
-				checked={getEditOnLogin()}
+				checked={getCanOnlyEditWhenLoggedIn()}
 				onchange={toggleUserEditOnLogin}
 			>
 			<div class="w-11 h-6 bg-gray-700 peer-focus:outline-none peer-focus:ring-2 peer-focus:ring-blue-600 rounded-full peer peer-checked:after:translate-x-full rtl:peer-checked:after:-translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:start-[2px] after:bg-white after:border-gray-300 after:border after:rounded-full after:h-5 after:w-5 after:transition-all peer-checked:bg-blue-600"></div>
diff --git a/src/lib/stores/loginStore.ts b/src/lib/stores/loginStore.ts
index 9ecc6c46..27eede3d 100644
--- a/src/lib/stores/loginStore.ts
+++ b/src/lib/stores/loginStore.ts
@@ -1,4 +1,4 @@
-import { writable } from 'svelte/store';
+import { get, writable } from 'svelte/store';
 
 export interface LoginState {
   isLoggedIn: boolean;
@@ -7,7 +7,6 @@ export interface LoginState {
   permissionLevel: number;
 }
 
-
 const initialState: LoginState = {
 	isLoggedIn: false,
 	name: '',
@@ -15,17 +14,34 @@ const initialState: LoginState = {
 	permissionLevel: 0,
 };
 
-export function toggleEditOnLogin(value?: boolean) {
-	if (value !== undefined && typeof window !== 'undefined') {
-		localStorage.setItem('editOnLogin', String(value));
+export const login = writable<LoginState>(initialState);
+
+export function getCanOnlyEditWhenLoggedIn() {
+	if (typeof window === 'undefined') {
+		throw new Error('Could not get permission canOnlyEditWhenLoggedIn: window is undefined');
 	}
+
+	return localStorage.getItem('editOnLogin') === 'true';
 }
 
-export function getEditOnLogin() {
+export function setCanOnlyEditWhenLoggedIn(value: boolean) {
 	if (typeof window === 'undefined') {
-		return false;
+		throw new Error('Could not set permission canOnlyEditWhenLoggedIn: window is undefined');
 	}
-	return localStorage.getItem('editOnLogin') === 'true';
+
+	localStorage.setItem('editOnLogin', String(value));
+}
+
+export function permissionsAllowEdit(minimumPermissionLevel: number) {
+	return !getCanOnlyEditWhenLoggedIn() || currentPermissionLevelIsAtLeast(minimumPermissionLevel);
 }
 
-export const login = writable<LoginState>(initialState);
\ No newline at end of file
+export function currentPermissionLevel() {
+	const currentLogin = get(login);
+	return currentLogin.permissionLevel ?? 0;
+}
+
+export function currentPermissionLevelIsAtLeast(level: number) {
+	const currentLogin = get(login);
+	return currentLogin?.isLoggedIn && currentLogin?.permissionLevel >= level;
+}
diff --git a/src/routes/+page.svelte b/src/routes/+page.svelte
index 69f23932..6d6b5fee 100644
--- a/src/routes/+page.svelte
+++ b/src/routes/+page.svelte
@@ -16,8 +16,7 @@
 		dragDropMode,
 		setDragDropMode,
 	} from "$lib/stores/dragDropStore.js";
-	import type { LoginState } from "$lib/stores/loginStore.js";
-	import { getEditOnLogin, login } from "$lib/stores/loginStore.js";
+	import { permissionsAllowEdit } from "$lib/stores/loginStore.js";
 	import { topBarHeight } from "$lib/stores/topBarStore.js";
 	import "$lib/styles/main.css";
 	import { Switch } from "@skeletonlabs/skeleton-svelte";
@@ -60,11 +59,6 @@
 
 	let itemTreeRef = $state<{ reload: () => Promise<void> } | null>(null);
 
-	let currentLogin = $state<LoginState | undefined>();
-	login.subscribe((value) => {
-		currentLogin = value;
-	});
-
 	$effect(() => {
 		if (showMoveDialog) {
 			moveDialog?.showModal();
@@ -368,7 +362,7 @@
 		{/each}
 	{/if}
 
-	{#if !getEditOnLogin() || (currentLogin?.isLoggedIn && currentLogin?.permissionLevel > 1)}
+	{#if permissionsAllowEdit(2)}
 		<button
 			class="add-button text-icon font-bold shadow"
 			onclick={() => {
diff --git a/src/routes/view/[id]/+page.svelte b/src/routes/view/[id]/+page.svelte
index f97d27ba..e1c8327c 100644
--- a/src/routes/view/[id]/+page.svelte
+++ b/src/routes/view/[id]/+page.svelte
@@ -14,8 +14,7 @@
 	import TopBar from "$lib/components/TopBar.svelte";
 	import Window from "$lib/components/Window.svelte";
 	import type { IBasicItemPopulated } from "$lib/server/db/models/basicItem.js";
-	import type { LoginState } from "$lib/stores/loginStore.js";
-	import { getEditOnLogin } from "$lib/stores/loginStore.js";
+	import { permissionsAllowEdit } from "$lib/stores/loginStore.js";
 	import type { PageData } from "./$types";
 
 	let {
@@ -40,7 +39,6 @@
 	let draggingItem = $state<IBasicItemPopulated | null>(null);
 	let targetItemId = $state<string | undefined>(undefined);
 	let targetItemName = $state<string | undefined>(undefined);
-	let currentLogin = $state<LoginState | undefined>();
 
 	$effect(() => {
 		if (browser && item) {
@@ -364,9 +362,7 @@
 		}} />
 </Dialog>
 
-
-
-{#if !getEditOnLogin() || (currentLogin?.isLoggedIn && currentLogin?.permissionLevel > 1)}
+{#if permissionsAllowEdit(2)}
 	<button
 		class="add-button text-icon font-bold shadow"
 		onclick={() => createDialog?.showModal()}>
diff --git a/src/routes/viewTemplates/+page.svelte b/src/routes/viewTemplates/+page.svelte
index 8defd111..2c019e81 100644
--- a/src/routes/viewTemplates/+page.svelte
+++ b/src/routes/viewTemplates/+page.svelte
@@ -5,8 +5,7 @@
 	import TemplateList from "$lib/components/TemplateList.svelte";
 	import TopBar from "$lib/components/TopBar.svelte";
 	import type { ITemplatePopulated } from "$lib/server/db/models/template.js";
-	import type { LoginState } from "$lib/stores/loginStore.js";
-	import { getEditOnLogin, login } from "$lib/stores/loginStore.js";
+	import { permissionsAllowEdit } from "$lib/stores/loginStore.js";
 	import { onMount } from "svelte";
 
 	import "$lib/styles/main.css";
@@ -15,11 +14,6 @@
 	let menu = $state<HTMLDialogElement>();
 	let templateDialog = $state<HTMLDialogElement | undefined>();
 
-	let currentLogin = $state<LoginState | undefined>();
-	login.subscribe((value) => {
-		currentLogin = value;
-	});
-
 	async function fetchTemplates() {
 		try {
 			const response = await fetch(`/api/templates`);
@@ -72,7 +66,7 @@
 	<Menu bind:menu />
 	<TemplateList {templates} />
 
-	{#if !getEditOnLogin() || (currentLogin?.isLoggedIn && currentLogin?.permissionLevel > 1)}
+	{#if permissionsAllowEdit(2)}
 		<button
 			class="add-button text-icon font-bold shadow"
 			onclick={() => {

From 43a0a66b6c4851d74ae62e83cd39479e00985df3 Mon Sep 17 00:00:00 2001
From: rhit-steineig <116207222+rhit-steineig@users.noreply.github.com>
Date: Sun, 3 May 2026 19:46:09 -0400
Subject: [PATCH 2/4] reduced duplicated login logic

---
 src/lib/utility/loginHelper.ts          | 24 +++++++++++++++++++
 src/routes/api/auth/login/+server.ts    | 27 ++++-----------------
 src/routes/api/auth/register/+server.ts | 32 +++++++------------------
 3 files changed, 37 insertions(+), 46 deletions(-)
 create mode 100644 src/lib/utility/loginHelper.ts

diff --git a/src/lib/utility/loginHelper.ts b/src/lib/utility/loginHelper.ts
new file mode 100644
index 00000000..941aba74
--- /dev/null
+++ b/src/lib/utility/loginHelper.ts
@@ -0,0 +1,24 @@
+import { json } from '@sveltejs/kit';
+import jwt from 'jsonwebtoken';
+
+const JWT_SECRET = process.env.JWT_SECRET || 'your_jwt_secret_key';
+const TOKEN_EXPIRATION = '24h';
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export function loginCore(user: any, successMessage: string, successCode: number){
+	const token = jwt.sign(
+		{ id: user._id, username: user.username, permissionLevel: user.permissionLevel },
+		JWT_SECRET,
+		{ expiresIn: TOKEN_EXPIRATION }
+	);
+
+	return json({
+		message: successMessage,
+		token,
+		user: {
+			id: user._id,
+			username: user.username,
+			permissionLevel: user.permissionLevel
+		}
+	}, { status: successCode });
+}
diff --git a/src/routes/api/auth/login/+server.ts b/src/routes/api/auth/login/+server.ts
index 8bc609eb..dff8aff2 100644
--- a/src/routes/api/auth/login/+server.ts
+++ b/src/routes/api/auth/login/+server.ts
@@ -1,9 +1,7 @@
-import { json, error } from '@sveltejs/kit';
-import type { RequestHandler } from '@sveltejs/kit';
-import jwt from 'jsonwebtoken';
 import User from '$lib/server/db/models/user.js';
-
-const JWT_SECRET = process.env.JWT_SECRET || 'your_jwt_secret_key';
+import { loginCore } from '$lib/utility/loginHelper';
+import type { RequestHandler } from '@sveltejs/kit';
+import { error } from '@sveltejs/kit';
 
 export const POST: RequestHandler = async ({ request }) => {
 	const { username, password } = await request.json();
@@ -20,20 +18,5 @@ export const POST: RequestHandler = async ({ request }) => {
 		throw error(401, 'Invalid credentials');
 	}
 
-	// Generate JWT token
-	const token = jwt.sign(
-		{ id: user._id, username: user.username, permissionLevel: user.permissionLevel },
-		JWT_SECRET,
-		{ expiresIn: '24h' }
-	);
-
-	return json({
-		message: 'Login successful',
-		token,
-		user: {
-			id: user._id,
-			username: user.username,
-			permissionLevel: user.permissionLevel
-		}
-	}, { status: 200 });
-};
\ No newline at end of file
+	return loginCore(user, 'Login successful', 200);
+};
diff --git a/src/routes/api/auth/register/+server.ts b/src/routes/api/auth/register/+server.ts
index a8e34784..e7ecd146 100644
--- a/src/routes/api/auth/register/+server.ts
+++ b/src/routes/api/auth/register/+server.ts
@@ -1,9 +1,7 @@
-import { json, error } from '@sveltejs/kit';
-import type { RequestHandler } from '@sveltejs/kit';
-import jwt from 'jsonwebtoken';
 import User from '$lib/server/db/models/user.js';
-
-const JWT_SECRET = process.env.JWT_SECRET || 'your_jwt_secret_key';
+import { loginCore } from '$lib/utility/loginHelper';
+import type { RequestHandler } from '@sveltejs/kit';
+import { error } from '@sveltejs/kit';
 
 export const POST: RequestHandler = async ({ request }) => {
 	const { username, password } = await request.json();
@@ -22,28 +20,14 @@ export const POST: RequestHandler = async ({ request }) => {
 	const user = new User({
 		username,
 		passwordHash: password,
-		// First user gets level 10, after default is 1
+		// First user gets level 10, afterwards default is 1
 		permissionLevel: isFirstUser ? 10 : 1
 	});
 
 	await user.save();
 
-	// Generate JWT token
-	const token = jwt.sign(
-		{ id: user._id, username: user.username, permissionLevel: user.permissionLevel },
-		JWT_SECRET,
-		{ expiresIn: '24h' }
-	);
+	const userIdentifier = isFirstUser ? 'Admin user' : 'User';
+	const successMessage = userIdentifier + " registered successfully";
 
-	return json({
-		message: isFirstUser ?
-			'Admin user registered successfully' :
-			'User registered successfully',
-		token,
-		user: {
-			id: user._id,
-			username: user.username,
-			permissionLevel: user.permissionLevel
-		}
-	}, { status: 201 });
-};
\ No newline at end of file
+	return loginCore(user, successMessage, 201);
+};

From 2cf16a3c811af9e42d7ebe97523598e57111ee0b Mon Sep 17 00:00:00 2001
From: rhit-steineig <116207222+rhit-steineig@users.noreply.github.com>
Date: Sun, 3 May 2026 19:59:36 -0400
Subject: [PATCH 3/4] general auth cleanup

---
 src/lib/server/auth.ts                           | 7 +++----
 src/lib/server/db/models/authenticatorAccount.ts | 4 ++--
 src/lib/server/db/models/login.ts                | 4 ++--
 src/lib/server/db/models/user.ts                 | 6 +++---
 src/routes/api/auth/permisisons/+server.ts       | 7 ++++---
 src/routes/api/auth/profile/+server.ts           | 4 ++--
 src/routes/api/auth/users/+server.ts             | 8 ++++----
 src/routes/users/+page.server.ts                 | 2 +-
 8 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/src/lib/server/auth.ts b/src/lib/server/auth.ts
index 26ed36b0..03ed8f91 100644
--- a/src/lib/server/auth.ts
+++ b/src/lib/server/auth.ts
@@ -1,6 +1,6 @@
-import jwt from 'jsonwebtoken';
 import type { RequestEvent } from '@sveltejs/kit';
 import { error } from '@sveltejs/kit';
+import jwt from 'jsonwebtoken';
 
 const JWT_SECRET = process.env.JWT_SECRET || 'your_jwt_secret_key';
 
@@ -19,11 +19,10 @@ interface OAuthJWTPayload {
 
 type JWTPayload = UserJWTPayload | OAuthJWTPayload;
 
-function isOAuthPayload(payload: JWTPayload): payload is OAuthJWTPayload {
+export function isOAuthPayload(payload: JWTPayload): payload is OAuthJWTPayload {
 	return 'sub_id' in payload;
 }
 
-
 export function verifyToken(token: string | undefined): JWTPayload | null {
 	if (!token || token === '') return null;
 	
@@ -75,4 +74,4 @@ export function getUserId(payload: JWTPayload): string {
 
 export function getUserName(payload: JWTPayload): string {
 	return isOAuthPayload(payload) ? payload.name : payload.username;
-}
\ No newline at end of file
+}
diff --git a/src/lib/server/db/models/authenticatorAccount.ts b/src/lib/server/db/models/authenticatorAccount.ts
index 5cbf7a64..ff0e0758 100644
--- a/src/lib/server/db/models/authenticatorAccount.ts
+++ b/src/lib/server/db/models/authenticatorAccount.ts
@@ -1,5 +1,5 @@
-import mongoose from 'mongoose';
 import type { Document } from 'mongoose';
+import mongoose from 'mongoose';
 const { Schema, model } = mongoose;
 
 export interface IAuthenticatorAccount extends Document {
@@ -22,4 +22,4 @@ interface AuthenticatorAccountModel extends mongoose.Model<IAuthenticatorAccount
     findByUsername(username: string): Promise<IAuthenticatorAccount | null>;
 }
 
-export const AuthenticatorAccount = model<IAuthenticatorAccount, AuthenticatorAccountModel>('AuthenticatorAccount', AuthenticatorAccountSchema);
\ No newline at end of file
+export const AuthenticatorAccount = model<IAuthenticatorAccount, AuthenticatorAccountModel>('AuthenticatorAccount', AuthenticatorAccountSchema);
diff --git a/src/lib/server/db/models/login.ts b/src/lib/server/db/models/login.ts
index cfdc268e..68ab547a 100644
--- a/src/lib/server/db/models/login.ts
+++ b/src/lib/server/db/models/login.ts
@@ -1,5 +1,5 @@
-import mongoose, { Types } from 'mongoose';
 import type { Document } from 'mongoose';
+import mongoose, { Types } from 'mongoose';
 const { Schema, model } = mongoose;
 
 export enum ServiceType {
@@ -37,4 +37,4 @@ interface LoginModel extends mongoose.Model<ILogin> {
     findByLoginId(login_id: string): Promise<ILogin | null>;
 }
 
-export const Login = model<ILogin, LoginModel>('Login', LoginSchema);
\ No newline at end of file
+export const Login = model<ILogin, LoginModel>('Login', LoginSchema);
diff --git a/src/lib/server/db/models/user.ts b/src/lib/server/db/models/user.ts
index 0f3d6d7d..f54578e6 100644
--- a/src/lib/server/db/models/user.ts
+++ b/src/lib/server/db/models/user.ts
@@ -1,12 +1,12 @@
-import mongoose, { Types } from 'mongoose';
+import bcrypt from 'bcryptjs';
 import type { Document } from 'mongoose';
+import mongoose, { Types } from 'mongoose';
 const { Schema, model } = mongoose;
-import bcrypt from 'bcryptjs';
 
 export interface IUser extends Document {
   _id: Types.ObjectId;
   username: string;
-  passwordHash: string; //we dont store actual password
+  passwordHash: string; //we don't store actual password
   permissionLevel: number;
   createdAt: Date;
   updatedAt: Date;
diff --git a/src/routes/api/auth/permisisons/+server.ts b/src/routes/api/auth/permisisons/+server.ts
index 3b857413..9b3555a6 100644
--- a/src/routes/api/auth/permisisons/+server.ts
+++ b/src/routes/api/auth/permisisons/+server.ts
@@ -1,4 +1,4 @@
-import { requirePermissionLevel } from '$lib/server/auth.js';
+import { isOAuthPayload, requirePermissionLevel } from '$lib/server/auth.js';
 import User from '$lib/server/db/models/user.js';
 import type { RequestHandler } from '@sveltejs/kit';
 import { error, json } from '@sveltejs/kit';
@@ -28,7 +28,8 @@ export const PUT: RequestHandler = async (event) => {
 	}
 
 	// Don't allow modifying own permissions
-	if (targetUser._id.toString() === currentUser.id) {
+	let currentUserId: string = isOAuthPayload(currentUser) ? currentUser.sub_id : currentUser.id;
+	if (targetUser._id.toString() === currentUserId) {
 		throw error(400, 'Cannot modify your own permission level');
 	}
 
@@ -53,4 +54,4 @@ export const PUT: RequestHandler = async (event) => {
 			permissionLevel: targetUser.permissionLevel
 		}
 	});
-};
\ No newline at end of file
+};
diff --git a/src/routes/api/auth/profile/+server.ts b/src/routes/api/auth/profile/+server.ts
index 6fdf114f..2ed32d44 100644
--- a/src/routes/api/auth/profile/+server.ts
+++ b/src/routes/api/auth/profile/+server.ts
@@ -1,4 +1,4 @@
-import { requireAuth } from '$lib/server/auth.js';
+import { isOAuthPayload, requireAuth } from '$lib/server/auth.js';
 import { Login } from '$lib/server/db/models/login.js';
 import User from '$lib/server/db/models/user.js';
 import type { RequestHandler } from '@sveltejs/kit';
@@ -9,7 +9,7 @@ export const GET: RequestHandler = async (event) => {
 	const authUser = requireAuth(event);
 
 	// Check if OAuth (Login model)
-	if ('sub_id' in authUser) {
+	if (isOAuthPayload(authUser)) {
 		const login = await Login.findOne({ login_id: authUser.sub_id });
 		if (!login) {
 			throw error(404, 'User not found');
diff --git a/src/routes/api/auth/users/+server.ts b/src/routes/api/auth/users/+server.ts
index 725f1671..fca7b2d7 100644
--- a/src/routes/api/auth/users/+server.ts
+++ b/src/routes/api/auth/users/+server.ts
@@ -1,8 +1,8 @@
-import { json } from '@sveltejs/kit';
-import type { RequestHandler } from '@sveltejs/kit';
 import { requirePermissionLevel } from '$lib/server/auth.js';
-import User from '$lib/server/db/models/user.js';
 import { Login } from '$lib/server/db/models/login.js';
+import User from '$lib/server/db/models/user.js';
+import type { RequestHandler } from '@sveltejs/kit';
+import { json } from '@sveltejs/kit';
 
 export const GET: RequestHandler = async (event) => {
 	try {
@@ -39,4 +39,4 @@ export const GET: RequestHandler = async (event) => {
 			error: err instanceof Error ? err.message : String(err)
 		}, { status: 500 });
 	}
-};
\ No newline at end of file
+};
diff --git a/src/routes/users/+page.server.ts b/src/routes/users/+page.server.ts
index e1ebca4c..782646e7 100644
--- a/src/routes/users/+page.server.ts
+++ b/src/routes/users/+page.server.ts
@@ -6,4 +6,4 @@ export const load: PageServerLoad = async ({ cookies }) => {
 	return {
 		isLoggedIn: !!authToken
 	};
-};
\ No newline at end of file
+};

From 6b5b3f902b3dfdd2fd58f18a45d87685277f9c35 Mon Sep 17 00:00:00 2001
From: rhit-steineig <116207222+rhit-steineig@users.noreply.github.com>
Date: Sun, 3 May 2026 22:35:20 -0400
Subject: [PATCH 4/4] reduced duplication in callback code

---
 .../api/oauth/callbackGithub/+server.ts       | 73 +++-------------
 .../api/oauth/callbackGoogle/+server.ts       | 83 ++++--------------
 src/routes/api/oauth/callbackHelper.ts        | 87 +++++++++++++++++++
 3 files changed, 118 insertions(+), 125 deletions(-)
 create mode 100644 src/routes/api/oauth/callbackHelper.ts

diff --git a/src/routes/api/oauth/callbackGithub/+server.ts b/src/routes/api/oauth/callbackGithub/+server.ts
index d97d1bf9..458a0cfe 100644
--- a/src/routes/api/oauth/callbackGithub/+server.ts
+++ b/src/routes/api/oauth/callbackGithub/+server.ts
@@ -1,82 +1,35 @@
-import { redirect, error } from '@sveltejs/kit';
+import { ServiceType } from '$lib/server/db/models/login.js';
 import type { RequestHandler } from '@sveltejs/kit';
-import jwt from 'jsonwebtoken';
+import { redirect, type Cookies } from '@sveltejs/kit';
 import * as arctic from 'arctic';
-import { Login, ServiceType } from '$lib/server/db/models/login.js';
+import { callbackCore, getUser, processCallbackError, validateState } from '../callbackHelper';
 
-const JWT_SECRET = process.env.JWT_SECRET || 'your_jwt_secret_key';
 const github_client_id = process.env.GITHUB_CLIENT_ID || '';
 const github_client_secret = process.env.GITHUB_CLIENT_SECRET || '';
 const github_redirect_uri = process.env.GITHUB_REDIRECT_URI || '';
 
 export const GET: RequestHandler = async ({ url, cookies }) => {
 	const code = url.searchParams.get('code');
-	const returnedState = url.searchParams.get('state');
-	const storedState = cookies.get('github_oauth_state');
-
-	if (!code || !returnedState || !storedState || returnedState !== storedState) {
-		throw error(400, 'Invalid state returned');
-	}
+	validateState(url, cookies, code, "github_oauth_state");
 
 	try {
 		const github = new arctic.GitHub(github_client_id, github_client_secret, github_redirect_uri);
-		const tokens = await github.validateAuthorizationCode(code);
+		const tokens = await github.validateAuthorizationCode(code as string);
 		const accessToken = tokens.accessToken();
 
-		const response = await fetch('https://api.github.com/user', {
-			headers: {
-				Authorization: `Bearer ${accessToken}`
-			}
-		});
-
-		const user = await response.json();
+		const user = await getUser('https://api.github.com/user', accessToken);
 		const id = String(user.id);
 		const name = user.name || user.login;
 
-		let existingLogin = await Login.findOne({ login_id: id, service_type: ServiceType.GITHUB });
-
-		if (!existingLogin) {
-			const loginCount = await Login.countDocuments({});
-			const isFirstLogin = loginCount === 0;
-
-			const newLogin = new Login({
-				login_id: id,
-				service_type: ServiceType.GITHUB,
-				name: name,
-				permissionLevel: isFirstLogin ? 10 : 1
-			});
-
-			await newLogin.save();
-			existingLogin = newLogin;
-		}
-
-		const token = jwt.sign(
-			{
-				sub_id: existingLogin.login_id,
-				name: name,
-				permissionLevel: existingLogin.permissionLevel
-			},
-			JWT_SECRET,
-			{ expiresIn: '7d' }
-		);
-
-		cookies.delete('github_oauth_state', { path: '/' });
-		cookies.set('auth_token', token, {
-			path: '/',
-			httpOnly: true,
-			secure: process.env.NODE_ENV === 'production',
-			sameSite: 'lax',
-			maxAge: 60 * 60 * 24 * 7
-		});
+		await callbackCore(id, name, ServiceType.GITHUB, cookies, deleteOldCookies);
 
 		throw redirect(302, '/oauth/success');
 	} catch (e) {
-		if (e instanceof arctic.OAuth2RequestError) {
-			throw error(400, `OAuth2 request error: ${e.message}`);
-		}
-		if (e instanceof arctic.ArcticFetchError) {
-			throw error(400, `Arctic Fetch Error: ${e.message}`);
-		}
-		throw e;
+		processCallbackError(e);
+		return new Response('Authentication failed', { status: 400 });
 	}
 };
+
+const deleteOldCookies = (cookies: Cookies) => {
+	cookies.delete('github_oauth_state', { path: '/' });
+}
diff --git a/src/routes/api/oauth/callbackGoogle/+server.ts b/src/routes/api/oauth/callbackGoogle/+server.ts
index 66ab5f02..f34aa04a 100644
--- a/src/routes/api/oauth/callbackGoogle/+server.ts
+++ b/src/routes/api/oauth/callbackGoogle/+server.ts
@@ -1,88 +1,41 @@
-import { redirect, error } from '@sveltejs/kit';
+import { ServiceType } from '$lib/server/db/models/login.js';
 import type { RequestHandler } from '@sveltejs/kit';
-import jwt from 'jsonwebtoken';
+import { error, redirect, type Cookies } from '@sveltejs/kit';
 import * as arctic from 'arctic';
-import { Login, ServiceType } from '$lib/server/db/models/login.js';
+import { callbackCore, getUser, processCallbackError, validateState } from '../callbackHelper';
 
-const JWT_SECRET = process.env.JWT_SECRET || 'your_jwt_secret_key';
 const google_client_id = process.env.GOOGLE_CLIENT_ID || '';
 const google_client_secret = process.env.GOOGLE_CLIENT_SECRET || '';
 const google_redirect_uri = process.env.GOOGLE_REDIRECT_URI || '';
 
 export const GET: RequestHandler = async ({ url, cookies }) => {
 	const code = url.searchParams.get('code');
-	const returnedState = url.searchParams.get('state');
-	const storedState = cookies.get('google_oauth_state');
-	const codeVerifier = cookies.get('google_code_verifier');
-
-	if (!code || !returnedState || !storedState || returnedState !== storedState) {
-		throw error(400, 'Invalid state returned');
-	}
-
-	if (!codeVerifier) {
+	validateState(url, cookies, code, "google_oauth_state");
+	
+	const googleCodeVerifier = cookies.get('google_code_verifier');
+	if (!googleCodeVerifier) {
 		throw error(400, 'Code verifier not found');
 	}
 
 	try {
 		const google = new arctic.Google(google_client_id, google_client_secret, google_redirect_uri);
-		const tokens = await google.validateAuthorizationCode(code, codeVerifier);
+		const tokens = await google.validateAuthorizationCode(code as string, googleCodeVerifier);
 		const accessToken = tokens.accessToken();
 
-		const response = await fetch('https://openidconnect.googleapis.com/v1/userinfo', {
-			headers: {
-				Authorization: `Bearer ${accessToken}`
-			}
-		});
-
-		const user = await response.json();
-		const sub_id = user.sub;
+		const user = await getUser('https://openidconnect.googleapis.com/v1/userinfo', accessToken);
+		const id = user.sub;
 		const name = user.name;
 
-		let existingLogin = await Login.findOne({ login_id: sub_id, service_type: ServiceType.GOOGLE });
-
-		if (!existingLogin) {
-			const loginCount = await Login.countDocuments({});
-			const isFirstLogin = loginCount === 0;
-
-			const newLogin = new Login({
-				login_id: sub_id,
-				name: name,
-				service_type: ServiceType.GOOGLE,
-				permissionLevel: isFirstLogin ? 10 : 1
-			});
-
-			await newLogin.save();
-			existingLogin = newLogin;
-		}
-
-		const token = jwt.sign(
-			{
-				sub_id: existingLogin.login_id,
-				name: name,
-				permissionLevel: existingLogin.permissionLevel
-			},
-			JWT_SECRET,
-			{ expiresIn: '7d' }
-		);
-
-		cookies.delete('google_oauth_state', { path: '/' });
-		cookies.delete('google_code_verifier', { path: '/' });
-		cookies.set('auth_token', token, {
-			path: '/',
-			httpOnly: true,
-			secure: process.env.NODE_ENV === 'production',
-			sameSite: 'lax',
-			maxAge: 60 * 60 * 24 * 7
-		});
+		await callbackCore(id, name, ServiceType.GOOGLE, cookies, deleteOldCookies);
 
 		throw redirect(302, '/oauth/success');
 	} catch (e) {
-		if (e instanceof arctic.OAuth2RequestError) {
-			throw error(400, `OAuth2 request error: ${e.message}`);
-		}
-		if (e instanceof arctic.ArcticFetchError) {
-			throw error(400, `Arctic Fetch Error: ${e.message}`);
-		}
-		throw e;
+		processCallbackError(e);
+		return new Response('Authentication failed', { status: 400 });
 	}
 };
+
+const deleteOldCookies = (cookies: Cookies) => {
+	cookies.delete('google_oauth_state', { path: '/' });
+	cookies.delete('google_code_verifier', { path: '/' });
+}
diff --git a/src/routes/api/oauth/callbackHelper.ts b/src/routes/api/oauth/callbackHelper.ts
new file mode 100644
index 00000000..462b5535
--- /dev/null
+++ b/src/routes/api/oauth/callbackHelper.ts
@@ -0,0 +1,87 @@
+import { Login, ServiceType } from '$lib/server/db/models/login.js';
+import { error, type Cookies } from '@sveltejs/kit';
+import * as arctic from 'arctic';
+import jwt from 'jsonwebtoken';
+
+const JWT_SECRET = process.env.JWT_SECRET || 'your_jwt_secret_key';
+const TOKEN_EXPIRATION_STR = '7d';
+const TOKEN_EXPIRATION_SECONDS = 60 * 60 * 24 * 7;
+
+export function validateState(url: URL, cookies: Cookies, code: string | null, storedStateKey: string) {
+	const returnedState = url.searchParams.get('state');
+	const storedState = cookies.get(storedStateKey);
+
+	const valid = code && returnedState && storedState && returnedState === storedState;
+	if (!valid) {
+		throw error(400, 'Invalid state returned');
+	}
+}
+
+export async function getUser(url: string, accessToken: string){
+	const response = await fetch(url, {
+		headers: {
+			Authorization: `Bearer ${accessToken}`
+		}
+	});
+	const user = await response.json();
+	return user;
+}
+
+export async function callbackCore(id: string, name: string, serviceType: ServiceType, cookies: Cookies, deleteOldCookies: (cookies: Cookies) => void) {
+	let existingLogin = await Login.findOne({ login_id: id, service_type: serviceType});
+	if (!existingLogin) {
+		existingLogin = await getNewLogin(id, name, serviceType);
+	}
+
+	const token = getToken(existingLogin, name);
+	deleteOldCookies(cookies);
+	setNewCookies(cookies, token);
+}
+
+async function getNewLogin(id: string, name: string, serviceType: ServiceType,) {
+	const loginCount = await Login.countDocuments({});
+	const isFirstLogin = loginCount === 0;
+	
+	const newLogin = new Login({
+		login_id: id,
+		name: name,
+		service_type: serviceType,
+		permissionLevel: isFirstLogin ? 10 : 1
+	});
+	
+	await newLogin.save();
+	return newLogin;
+}
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function getToken(existingLogin: any, name: string) {
+	return jwt.sign(
+		{
+			sub_id: existingLogin.login_id,
+			name: name,
+			permissionLevel: existingLogin.permissionLevel
+		},
+		JWT_SECRET,
+		{ expiresIn: TOKEN_EXPIRATION_STR }
+	);
+}
+
+function setNewCookies(cookies: Cookies, token: string){
+	cookies.set('auth_token', token, {
+		path: '/',
+		httpOnly: true,
+		secure: process.env.NODE_ENV === 'production',
+		sameSite: 'lax',
+		maxAge: TOKEN_EXPIRATION_SECONDS
+	});
+}
+
+export function processCallbackError(callbackError: unknown) {
+	if (callbackError instanceof arctic.OAuth2RequestError) {
+		throw error(400, `OAuth2 request error: ${callbackError.message}`);
+	}
+	if (callbackError instanceof arctic.ArcticFetchError) {
+		throw error(400, `Arctic Fetch Error: ${callbackError.message}`);
+	}
+	throw callbackError;
+}