fix: isProtectedPath nel middleware, landingFor per cliente e trainer

src/lib/auth.ts

@@ -124,5 +124,18 @@ export function isRole(v: unknown): v is Role {
 export function landingFor(role: string): string {
   if (role === 'superuser') return '/admin/content';
   if (role === 'piattaforme') return '/piattaforme';
+  if (role === 'cliente') return '/longevity/io';
+  if (role === 'trainer') return '/longevity/gestionale';
   return '/admin';
 }
+
+export function isProtectedPath(pathname: string): boolean {
+  return (
+    (pathname.startsWith('/admin') && pathname !== '/admin/login') ||
+    pathname.startsWith('/api/admin') ||
+    pathname.startsWith('/campus') ||
+    pathname.startsWith('/piattaforme') ||
+    pathname.startsWith('/longevity') ||
+    pathname.startsWith('/api/longevity')
+  );
+}

src/middleware.ts

@@ -1,15 +1,10 @@
 import { defineMiddleware } from 'astro:middleware';
 import { getDb } from './lib/db';
-import { getSessionUser, SESSION_COOKIE, canAccessAdminPath, landingFor } from './lib/auth';
+import { getSessionUser, SESSION_COOKIE, canAccessAdminPath, landingFor, isProtectedPath } from './lib/auth';
 
 export const onRequest = defineMiddleware((context, next) => {
   const { pathname } = context.url;
-  const isProtected =
-    (pathname.startsWith('/admin') && pathname !== '/admin/login') ||
-    pathname.startsWith('/api/admin') ||
-    pathname.startsWith('/campus') ||
-    pathname.startsWith('/piattaforme');
-  if (!isProtected) return next();
+  if (!isProtectedPath(pathname)) return next();
 
   const token = context.cookies.get(SESSION_COOKIE)?.value;
   const user = token ? getSessionUser(getDb(), token) : null;

tests/longevity/ruoli.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import { canAccessAdminPath } from '../../src/lib/auth';
+import { canAccessAdminPath, isProtectedPath, landingFor } from '../../src/lib/auth';
 
 describe('accesso alle rotte longevity', () => {
   it('il cliente entra nel proprio spazio', () => {
@@ -29,3 +29,42 @@ describe('accesso alle rotte longevity', () => {
     expect(canAccessAdminPath('admin', '/longevity/gestionale')).toBe(true);
   });
 });
+
+describe('isProtectedPath — quali rotte sono protette dal middleware', () => {
+  it('longevity è protetto', () => {
+    expect(isProtectedPath('/longevity/io')).toBe(true);
+    expect(isProtectedPath('/longevity/gestionale')).toBe(true);
+    expect(isProtectedPath('/api/longevity/qualcosa')).toBe(true);
+  });
+
+  it('i percorsi già esistenti restano protetti', () => {
+    expect(isProtectedPath('/admin')).toBe(true);
+    expect(isProtectedPath('/admin/content')).toBe(true);
+    expect(isProtectedPath('/api/admin/content')).toBe(true);
+    expect(isProtectedPath('/campus')).toBe(true);
+    expect(isProtectedPath('/piattaforme')).toBe(true);
+  });
+
+  it('il login e le pagine pubbliche non sono protetti', () => {
+    expect(isProtectedPath('/admin/login')).toBe(false);
+    expect(isProtectedPath('/blog')).toBe(false);
+    expect(isProtectedPath('/')).toBe(false);
+  });
+});
+
+describe('landingFor — indirizzo di atterraggio per ruolo', () => {
+  it('cliente atterra su longevity/io', () => {
+    expect(landingFor('cliente')).toBe('/longevity/io');
+  });
+
+  it('trainer atterra su longevity/gestionale', () => {
+    expect(landingFor('trainer')).toBe('/longevity/gestionale');
+  });
+
+  it('i ruoli già esistenti restano uguali', () => {
+    expect(landingFor('superuser')).toBe('/admin/content');
+    expect(landingFor('piattaforme')).toBe('/piattaforme');
+    expect(landingFor('admin')).toBe('/admin');
+    expect(landingFor('user')).toBe('/admin');
+  });
+});