file based auth

src/servers/_middlewares/user-middleware.ts

@@ -2,7 +2,7 @@ import type { MiddlewareHandler } from 'hono';
 import { verify } from '@@/jwt';
 import * as errors from '@@/custom-errors';
 import { isOriginAllowed } from './origin-validation';
-import { officerdb, eq, Users, TokenBlacklist } from 'officerdb';
+import { getUserById, isTokenBlacklisted } from 'officerdb';
 
 // Role permissions: which HTTP methods each role can use
 // Roles not listed here are denied by default (fail-safe)
@@ -46,18 +46,12 @@ export const userMiddleware: MiddlewareHandler = async function (ctx, next) {
 
     // Check if token is blacklisted (explicit signout)
     if (user.jti) {
-      const blacklisted = await officerdb.query.TokenBlacklist.findFirst({
-        where: eq(TokenBlacklist.jti, user.jti),
-      });
-      if (blacklisted) throw errors.UNAUTHORIZED();
+      if (isTokenBlacklisted(user.jti)) throw errors.UNAUTHORIZED();
     }
 
     // Check if token was issued before password change
     if (user.iat && user.id) {
-      const dbUser = await officerdb.query.Users.findFirst({
-        where: eq(Users.id, user.id),
-        columns: { passwordChangedAt: true },
-      });
+      const dbUser = getUserById(user.id);
       if (dbUser?.passwordChangedAt) {
         // iat is in seconds, passwordChangedAt is in milliseconds
         const tokenIssuedAt = user.iat * 1000;