feat: restructure into XFlow monorepo with Nuxt 4, Modular Onion Monolith, Android client, and Desktop CLI

apps/web/server/utils/auth.ts

@@ -0,0 +1,61 @@
+import jwt from 'jsonwebtoken'
+import { H3Event, createError } from 'h3'
+
+export interface AuthUser {
+  id: string
+  email: string
+  username: string
+  displayName?: string
+  role?: string
+}
+
+export function generateToken(user: AuthUser): string {
+  const config = useRuntimeConfig()
+  const secret = config.jwtSecret || 'your-super-secret-jwt-key'
+  
+  return jwt.sign(
+    { 
+      id: user.id, 
+      email: user.email, 
+      username: user.username, 
+      displayName: user.displayName,
+      role: user.role || 'user' 
+    },
+    secret,
+    { expiresIn: '7d' }
+  )
+}
+
+export function verifyToken(token: string): AuthUser {
+  const config = useRuntimeConfig()
+  const secret = config.jwtSecret || 'your-super-secret-jwt-key'
+  
+  return jwt.verify(token, secret) as AuthUser
+}
+
+export function getAuthUser(event: H3Event): AuthUser | null {
+  const authHeader = getHeader(event, 'authorization')
+  const token = authHeader?.split(' ')[1]
+  if (!token) return null
+  try {
+    return verifyToken(token)
+  } catch {
+    return null
+  }
+}
+
+export function requireAuth(event: H3Event): AuthUser {
+  const user = getAuthUser(event)
+  if (!user) {
+    throw createError({ statusCode: 401, message: 'Unauthorized' })
+  }
+  return user
+}
+
+export function requireRole(event: H3Event, role: string): AuthUser {
+  const user = requireAuth(event)
+  if (user.role !== role) {
+    throw createError({ statusCode: 403, message: 'Forbidden' })
+  }
+  return user
+}