1
import type { Viewer } from "@/client/server/viewer";
2
import { findMembership } from "@/worker/db/d1/dal/namespaces";
3
import type { AppContext } from "@/worker/routes/hono";
4
 
5
import { loadViewer } from "./session";
6
 
7
// PAT credentials are deliberately not consulted here; the structural rule
8
// "PAT cannot authorize a browser surface" relies on UI/admin handlers
9
// importing only this module, never `gitAuth.ts`.
10
export type SessionMembershipResult =
11
  | { kind: "anonymous" }
12
  | { kind: "signed-in-non-member"; viewer: Viewer }
13
  | { kind: "member"; viewer: Viewer };
14
 
15
export async function loadSessionMembership(
16
  c: AppContext,
17
  namespaceId: string
18
): Promise<SessionMembershipResult> {
19
  const viewer = await loadViewer(c);
20
  if (!viewer) return { kind: "anonymous" };
21
  const membership = await findMembership(c.var.db, namespaceId, viewer.userId);
22
  if (!membership) return { kind: "signed-in-non-member", viewer };
23
  return { kind: "member", viewer };
24
}