feat: prisma schema, groups API, deploy workflow

app/server/utils/auth.ts

@@ -0,0 +1,50 @@
+import jwt from 'jsonwebtoken'
+import { H3Event, createError } from 'h3'
+
+const JWT_SECRET = process.env.NUXT_JWT_SECRET || 'your-super-secret-jwt-key'
+
+export interface AuthUser {
+  id: string
+  email: string
+  username: string
+  role?: string
+}
+
+export function generateToken(user: AuthUser): string {
+  return jwt.sign(
+    { id: user.id, email: user.email, username: user.username, role: user.role || 'user' },
+    JWT_SECRET,
+    { expiresIn: '7d' }
+  )
+}
+
+export function verifyToken(token: string): AuthUser {
+  return jwt.verify(token, JWT_SECRET) as AuthUser
+}
+
+export function getAuthUser(event: H3Event): AuthUser | null {
+  const authHeader = getHeader(event, 'authorization')
+  const token = authHeader?.split(' ')[1]
+  if (!token) return null
+  try {
+    return verifyToken(token)
+  } catch {
+    return null
+  }
+}
+
+export function requireAuth(event: H3Event): AuthUser {
+  const user = getAuthUser(event)
+  if (!user) {
+    throw createError({ statusCode: 401, message: 'Unauthorized' })
+  }
+  return user
+}
+
+export function requireRole(event: H3Event, role: string): AuthUser {
+  const user = requireAuth(event)
+  if (user.role !== role) {
+    throw createError({ statusCode: 403, message: 'Forbidden' })
+  }
+  return user
+}