Restore from Gitea ZIP snapshot (12.08.2026) after full instance reinstall

Git history was lost when the previous Gitea instance was wiped and
reinstalled due to an unresolved corruption bug — this commit is the
last known-good file content, exported before the reinstall. Prior
commit history is not recoverable through this path.

src/lib/auth/require.ts

@@ -0,0 +1,23 @@
+import { NextResponse } from "next/server";
+import { getCurrentSession } from "./session";
+
+/** Guard for API route handlers — returns the session, or a 401 response to return as-is. */
+export async function requireSession() {
+  const session = await getCurrentSession();
+  if (!session) {
+    return { session: null, response: NextResponse.json({ error: "Unauthorized" }, { status: 401 }) };
+  }
+  return { session, response: null };
+}
+
+/** Same as requireSession, but also requires role === "admin" — for account/LDAP management. */
+export async function requireAdminSession() {
+  const session = await getCurrentSession();
+  if (!session) {
+    return { session: null, response: NextResponse.json({ error: "Unauthorized" }, { status: 401 }) };
+  }
+  if (session.user.role !== "admin") {
+    return { session: null, response: NextResponse.json({ error: "Forbidden" }, { status: 403 }) };
+  }
+  return { session, response: null };
+}