✅ Location validators

Location mutation routes compose two shared authentication validator factories in sequence; public read/list routes compose neither. Their complete invocations appear in the protected Location route source.

Inventory

Validator	Reads	Success condition	Failure / error	Consumers
isAuthenticated()	context.authenticate (default getBearerTokenInfo)	Selected adapter resolves an access token.	Service adapters fail with 401; custom adapters can throw their own errors.	createLocationRoute, updateLocationRoute, deleteLocationRoute
checkIdentityType(['admin'])	context.authenticate, context.db.identities, context.configuration?.identity?.typeIds	Valid user-token identity has the configured admin type ID.	500 setup, 401 token, 403 identity/type/access.	createLocationRoute, updateLocationRoute, deleteLocationRoute

Details

isAuthenticated()

Implementation

Signature: isAuthenticated(): Validator. The returned validator runs first on createLocationRoute, updateLocationRoute, and deleteLocationRoute. It reads payload.context.authenticate, defaults to getBearerTokenInfo, and calls it with the full payload. It adds no database or identity-type check; see the canonical shared contract.

locationService supplies getBearerTokenInfo when authMode is omitted or 'bearer', and getCookieTokenInfo for 'cookie'. Bearer mode reads Authorization; cookie mode reads request.cookies.accessToken and requires host middleware to populate cookies. Both adapters verify access tokens using the configured secrets. For user tokens, fingerprint equality is always checked; the default IP check rejects an IP mismatch only when the user agent also differs. The request host is read but is not compared. Invalid token paths throw 401; custom adapters can throw their own errors. Public getLocationRoute and findLocationsRoute do not compose this validator.

Consumers: createLocationRoute, updateLocationRoute, and deleteLocationRoute.

checkIdentityType(['admin'])

Implementation

Signature: checkIdentityType(['admin']): Validator. This shared checkIdentityType validator runs second on createLocationRoute, updateLocationRoute, and deleteLocationRoute. It first requires payload.context.db.identities (500 db.identities is not set) and payload.context.configuration?.identity?.typeIds (500 configuration.identity.typeIds is not set). These setup checks precede its token authentication.

After setup, it authenticates again even though isAuthenticated() already ran. The token must satisfy isValidUserAccessToken; an app token accepted by the first validator is rejected here with 401 Invalid token. It uses getIdentityById to load the token identity from db.identities, then compares its typeId with configuration.identity.typeIds.admin. Lookup failure is 403 Failed to fetch identity, missing typeId is 403 Invalid identity type ID, and a non-admin type is 403 Identity is not authorized to access this resource. Public getLocationRoute and findLocationsRoute do not compose this validator.

Consumers: createLocationRoute, updateLocationRoute, and deleteLocationRoute.