import legacy frontend & fix dependency issues

packages/api/src/middleware/authentication.ts

@@ -8,8 +8,11 @@ function promisifyMiddleware(
     response?: Response,
 ): Promise<any> {
     return new Promise((resolve, reject) => {
-        middleware(request, response || ({} as any), (result: any) => {
-            result instanceof Error ? reject(result) : resolve(result);
+        middleware(request, response || ({} as any), (next_result: any) => {
+            console.dir(next_result);
+            next_result instanceof Error
+                ? reject(next_result)
+                : resolve(next_result);
         });
     });
 }
@@ -20,10 +23,15 @@ async function doKeycloakAuth(
     response?: Response,
 ): Promise<any> {
     if (roles && roles.length > 0) {
-        return await promisifyMiddleware(
-            request,
-            keycloak.enforcer(roles?.map(role => `realm:${role}`)),
+        const grant = await keycloak.getGrant(request, response ?? ({} as any));
+        const allowed = roles.every(role =>
+            grant.access_token?.hasRealmRole(role),
         );
+        if (allowed) {
+            return Promise.resolve();
+        } else {
+            return Promise.reject(httpError(403, "Forbidden"));
+        }
     } else {
         return await promisifyMiddleware(request, keycloak.protect(), response);
     }
@@ -35,12 +43,21 @@ export async function expressAuthentication(
     roles?: string[],
     response?: Response,
 ): Promise<any> {
+    if (request.method === "OPTIONS") {
+        return Promise.resolve();
+    }
     switch (securityName) {
         case KC_SECURITY_NAME:
-            return doKeycloakAuth(request, roles, response);
+            return await doKeycloakAuth(request, roles, response);
         case undefined:
             return Promise.resolve();
         default:
-            return Promise.reject("Unknown security name");
+            return Promise.reject(httpError(400, "Unknown security name"));
     }
 }
+
+function httpError(status: number, message: string) {
+    const err: any = new Error(message);
+    err.status = status;
+    return err;
+}