Sessions 5-7a: 955 tests, deployment ready

web/src/lib/auth-helpers.ts

@@ -0,0 +1,39 @@
+import { NextRequest } from 'next/server';
+import { getServerSupabase } from './supabase';
+
+export interface AuthedUser {
+  id: string;
+  email: string | null;
+  tier: 'free' | 'analyst' | 'desk';
+}
+
+/**
+ * Verify a bearer token from the Authorization header against Supabase.
+ * Returns null when missing/invalid — callers decide whether to 401.
+ */
+export async function getUserFromRequest(req: NextRequest): Promise<AuthedUser | null> {
+  const auth = req.headers.get('authorization');
+  if (!auth || !auth.toLowerCase().startsWith('bearer ')) return null;
+
+  const sb = getServerSupabase(auth);
+  if (!sb) return null;
+
+  const { data, error } = await sb.auth.getUser();
+  if (error || !data.user) return null;
+
+  const { data: profile } = await sb
+    .from('user_profiles')
+    .select('tier')
+    .eq('id', data.user.id)
+    .maybeSingle();
+
+  return {
+    id: data.user.id,
+    email: data.user.email ?? null,
+    tier: ((profile?.tier as AuthedUser['tier']) ?? 'free'),
+  };
+}
+
+export function jsonError(status: number, message: string) {
+  return Response.json({ error: message }, { status });
+}