feat: implement incident reporting and management system

- Add incident reporting routes and logic to handle creation, updating, and retrieval of incidents.
- Implement visibility rules for users based on roles (reporters, supervisors).
- Create tests for incident reporting functionality to ensure correctness and reliability.
- Introduce site and area management routes, including validation for area hierarchy.
- Establish user management routes with role-based access control for creating and updating users.
- Add setup routes for initializing the application with an organization and admin user.
- Implement shared enums and schemas for consistent validation and data handling across the application.
- Create a test helper for setting up an in-memory database and API client for testing.
- Add TypeScript configuration for server-side code with strict type checking and module resolution.

server/auth/middleware.ts

@@ -0,0 +1,42 @@
+import type { Context, MiddlewareHandler } from 'hono'
+import { deleteCookie, getCookie, setCookie } from 'hono/cookie'
+import { hasRole, type Role } from '../../shared/enums.ts'
+import { currentUser, fail, type AppEnv } from '../lib/http.ts'
+import { createSession, deleteSession, SESSION_COOKIE, validateSession } from './sessions.ts'
+
+function writeCookie(c: Context<AppEnv>, token: string, expires: Date) {
+  setCookie(c, SESSION_COOKIE, token, { httpOnly: true, sameSite: 'Lax', secure: c.get('config').secureCookies, path: '/', expires })
+}
+
+/** Loads the user from the session cookie, if any. */
+export const loadSession: MiddlewareHandler<AppEnv> = async (c, next) => {
+  const token = getCookie(c, SESSION_COOKIE)
+  const session = token ? await validateSession(c.get('db'), token) : null
+  if (token && !session) deleteCookie(c, SESSION_COOKIE, { path: '/' })
+  if (token && session?.renewedUntil) writeCookie(c, token, session.renewedUntil)
+  c.set('user', session?.user ?? null)
+  await next()
+}
+
+export const requireAuth: MiddlewareHandler<AppEnv> = async (c, next) => {
+  currentUser(c)
+  await next()
+}
+
+export function requireRole(minimum: Role): MiddlewareHandler<AppEnv> {
+  return async (c, next) => {
+    if (!hasRole(currentUser(c).role, minimum)) throw fail(403, 'You do not have permission to do that')
+    await next()
+  }
+}
+
+export async function startSession(c: Context<AppEnv>, userId: string): Promise<void> {
+  const { token, expiresAt } = await createSession(c.get('db'), userId)
+  writeCookie(c, token, expiresAt)
+}
+
+export async function endSession(c: Context<AppEnv>): Promise<void> {
+  const token = getCookie(c, SESSION_COOKIE)
+  if (token) await deleteSession(c.get('db'), token)
+  deleteCookie(c, SESSION_COOKIE, { path: '/' })
+}