permissions & routes with middleware

src/middleware/authenticate.ts

@@ -37,6 +37,7 @@ export default async function authenticate(req: Request, res: Response, next: Fu
   req.username = decoded.username;
   req.isOwner = decoded.isOwner;
   req.permissions = decoded.permissions;
+  req.isWebApiRequest = decoded?.sub == "webapi_access_token";
 
   next();
 }

src/middleware/preventWebApiAccess.ts

@@ -0,0 +1,10 @@
+import { Request, Response } from "express";
+import ForbiddenRequestException from "../exceptions/forbiddenRequestException";
+
+export default async function preventApiAccess(req: Request, res: Response, next: Function) {
+  if (req.isWebApiRequest) {
+    throw new ForbiddenRequestException("This route cannot be accessed via webapi");
+  } else {
+    next();
+  }
+}