First commit

lib/auth/requireTeacher.ts

@@ -0,0 +1,26 @@
+import { redirect } from "next/navigation";
+import { requireUser } from "@/lib/auth/requireUser";
+
+const readTeacherEmails = (): string[] =>
+  (process.env.TEACHER_EMAILS ?? "")
+    .split(",")
+    .map((email) => email.trim().toLowerCase())
+    .filter(Boolean);
+
+export const requireTeacher = async () => {
+  const user = await requireUser("/teacher");
+  if (!user?.email) {
+    redirect("/");
+  }
+
+  const allowed = readTeacherEmails();
+  if (allowed.length === 0) {
+    redirect("/");
+  }
+
+  if (!allowed.includes(user.email.toLowerCase())) {
+    redirect("/");
+  }
+
+  return user;
+};

lib/auth/requireUser.ts

@@ -0,0 +1,16 @@
+import { redirect } from "next/navigation";
+import { supabaseServer } from "@/lib/supabase/server";
+
+export const requireUser = async (redirectTo: string) => {
+  const supabase = await supabaseServer();
+  if (!supabase) {
+    return null;
+  }
+
+  const { data } = await supabase.auth.getUser();
+  if (!data.user) {
+    redirect(`/auth/login?redirectTo=${encodeURIComponent(redirectTo)}`);
+  }
+
+  return data.user;
+};