fix: preserve request context in team auth fetches

Nuxt server-route docs say request headers and request context are not forwarded by default for server-side fetches, and event.$fetch should be used when that context should follow the internal request. The same server docs recommend passing event to useRuntimeConfig in server routes so runtime environment overrides are resolved against the active request.

This keeps the admin/team helpers on request-aware server primitives instead of ambient global fetch/config access.

Docs: https://nuxt.com/docs/4.x/directory-structure/server#forwarding-context-headers

Docs: https://nuxt.com/docs/4.x/directory-structure/server#runtime-config

Author: onmax

server/api/admin/mcp-install.get.ts

@@ -1,7 +1,7 @@
 export default defineEventHandler(async (event) => {
   const { user } = await requireUserSession(event)
 
-  if (!user?.login || !(await isAuthorizedAdmin(user.login))) {
+  if (!user?.login || !(await isAuthorizedAdmin(event, user.login))) {
     throw createError({ statusCode: 403, statusMessage: 'Admin access required' })
   }
 

server/api/auth/github.get.ts

@@ -1,6 +1,6 @@
 export default defineOAuthGitHubEventHandler({
   async onSuccess(event, { user }) {
-    const allowed = await isAuthorizedAdmin(user.login)
+    const allowed = await isAuthorizedAdmin(event, user.login)
 
     if (!allowed) {
       return sendRedirect(event, '/admin/login?error=access-denied')

server/api/v1/teams/index.get.ts

@@ -1,9 +1,9 @@
 import type { GitHubTeamMember } from '../../../types/github'
 
-export default defineCachedEventHandler(async () => {
+export default defineCachedEventHandler(async (event) => {
   const [core, _ecosystem] = await Promise.all([
-    $fetch<GitHubTeamMember[]>('/api/v1/teams/core'),
-    $fetch<GitHubTeamMember[]>('/api/v1/teams/ecosystem')
+    event.$fetch<GitHubTeamMember[]>('/api/v1/teams/core'),
+    event.$fetch<GitHubTeamMember[]>('/api/v1/teams/ecosystem')
   ])
 
   const filteredEcosystem = [] as GitHubTeamMember[]

server/utils/team.ts

@@ -1,12 +1,13 @@
 import type { GitHubTeamMember } from '../types/github'
+import type { H3Event } from 'h3'
 
-const getCoreMembers = cachedFunction((): Promise<GitHubTeamMember[]> => $fetch<GitHubTeamMember[]>('/api/v1/teams/core'), {
+const getCoreMembers = cachedFunction((event: H3Event): Promise<GitHubTeamMember[]> => event.$fetch<GitHubTeamMember[]>('/api/v1/teams/core'), {
   maxAge: 60 * 60 * 24 * 7, // 1 week
   getKey: () => 'core-members'
 })
 
-export async function isCoreTeamMember(login: string): Promise<boolean> {
-  const coreMembers = await getCoreMembers()
+export async function isCoreTeamMember(event: H3Event, login: string): Promise<boolean> {
+  const coreMembers = await getCoreMembers(event)
   if (!coreMembers || !Array.isArray(coreMembers)) {
     throw createError({
       statusCode: 500,
@@ -16,19 +17,19 @@ export async function isCoreTeamMember(login: string): Promise<boolean> {
   return coreMembers.some(member => member.login.toLowerCase() === login)
 }
 
-function getExtraAdminLogins(): string[] {
-  const raw = useRuntimeConfig().adminGithubLogins
+function getExtraAdminLogins(event: H3Event): string[] {
+  const raw = useRuntimeConfig(event).adminGithubLogins
   if (!raw) return []
   return raw
     .split(',')
     .map(login => login.trim().toLowerCase())
     .filter(Boolean)
 }
 
-export async function isAuthorizedAdmin(login: string): Promise<boolean> {
+export async function isAuthorizedAdmin(event: H3Event, login: string): Promise<boolean> {
   const normalized = login.toLowerCase()
-  if (getExtraAdminLogins().includes(normalized)) {
+  if (getExtraAdminLogins(event).includes(normalized)) {
     return true
   }
-  return isCoreTeamMember(normalized)
+  return isCoreTeamMember(event, normalized)
 }