migrate auth v2 code

frontend/src/routes/[fam]/+layout.server.ts

@@ -1,5 +1,5 @@
 import { PROXY_URL } from '$app/env/public';
-import { pbAdmin } from '$lib/server/pb-admin';
+import { pbAdmin } from '$lib/server/pocketbase';
 
 const HONO_URL = PROXY_URL;
 
@@ -20,19 +20,17 @@ async function paydayCheck(famId: string, headers: Record<string, string>) {
 async function resolveChatIdentity(
 	api: 'admin' | 'member',
 	opts: {
-		session?: { famId: string; userId: string };
-		deviceToken?: string;
-		famId?: string;
+		session?: { famId: string; id: string };
+		pbToken?: string;
 	}
 ) {
 	try {
 		const headers: Record<string, string> = { 'Content-Type': 'application/json' };
 		if (api === 'admin' && opts.session) {
 			headers['x-session-famid'] = opts.session.famId;
-			headers['x-session-userid'] = opts.session.userId;
-		} else if (api === 'member' && opts.deviceToken && opts.famId) {
-			headers['x-device-token'] = opts.deviceToken;
-			headers['x-device-famid'] = opts.famId;
+			headers['x-session-userid'] = opts.session.id;
+		} else if (api === 'member' && opts.pbToken) {
+			headers['Authorization'] = `Bearer ${opts.pbToken}`;
 		} else {
 			return null;
 		}
@@ -45,46 +43,43 @@ async function resolveChatIdentity(
 }
 
 export async function load(event) {
-	const session = event.locals.session || null;
-	const isParent = session !== null;
-	const deviceToken = event.cookies.get('device_token') || '';
+	const session = event.locals.user;
+	const role = session?.role || 'child';
+	const isParent = role === 'parent';
+	const pbToken = event.cookies.get('pb_token') || '';
 
 	let famId = '';
 	let chat: { famId: string; actor: any } | null = null;
 
-	if (isParent) {
+	if (session && isParent) {
 		famId = session.famId;
 		await paydayCheck(famId, {
 			'x-session-famid': session.famId,
-			'x-session-userid': session.userId
+			'x-session-userid': session.id
 		});
 		chat = await resolveChatIdentity('admin', { session });
-	} else if (deviceToken) {
-		try {
-			const res = await fetch(`${HONO_URL}/api/members/seasons`, {
-				headers: { 'x-device-token': deviceToken }
-			});
-			if (res.ok) {
-				const body = await res.json();
-				famId = body.famId || '';
-			}
-		} catch {}
-		if (famId) {
-			await paydayCheck(famId, {
-				'x-device-token': deviceToken,
-				'x-device-famid': famId
-			});
-			chat = await resolveChatIdentity('member', { deviceToken, famId });
-		}
+	} else if (role === 'child' && pbToken && session) {
+		famId = session.famId;
+		await paydayCheck(famId, { Authorization: `Bearer ${pbToken}` });
+		chat = await resolveChatIdentity('member', { pbToken });
 	}
 
 	return {
-		session,
+		session: session
+			? {
+					famId: session.famId,
+					userId: session.id,
+					famSlug: event.params.fam,
+					memberName: session.name,
+					memberColor: session.color || '',
+					role: session.role
+				}
+			: null,
 		isParent,
-		role: session?.role || 'child',
+		role,
 		famId,
 		chat,
-		deviceToken,
+		pbToken,
 		// fams is superadmin-only (non-realtime). Fetched server-side for both roles.
 		fam: famId
 			? await pbAdmin.getOne('fams', famId).catch(() => null)