forked from wrenn/wrenn
pptx704
8e5d426638
- Three-role model (owner/admin/member) with owner protection invariants - Team CRUD: create, rename (admin+), soft-delete with VM cleanup (owner only) - Member management: add by email, remove, role updates (admin+), leave - Switch-team endpoint re-issues JWT after DB membership verification - User email prefix search for add-member UI autocomplete - JWT carries role as a hint; all authorization decisions verified from DB - Team slug: immutable 12-char hex (e.g. a1b2c3-d1e2f3), reserved on soft-delete - Migration adds slug + deleted_at to teams; backfills existing rows
38 lines
1.1 KiB
Go
38 lines
1.1 KiB
Go
package api
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
|
|
"git.omukk.dev/wrenn/sandbox/internal/auth"
|
|
)
|
|
|
|
// requireJWT validates the Authorization: Bearer <token> header, verifies the JWT
|
|
// signature and expiry, and stamps UserID + TeamID + Email into the request context.
|
|
func requireJWT(secret []byte) func(http.Handler) http.Handler {
|
|
return func(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
header := r.Header.Get("Authorization")
|
|
if !strings.HasPrefix(header, "Bearer ") {
|
|
writeError(w, http.StatusUnauthorized, "unauthorized", "Authorization: Bearer <token> required")
|
|
return
|
|
}
|
|
|
|
tokenStr := strings.TrimPrefix(header, "Bearer ")
|
|
claims, err := auth.VerifyJWT(secret, tokenStr)
|
|
if err != nil {
|
|
writeError(w, http.StatusUnauthorized, "unauthorized", "invalid or expired token")
|
|
return
|
|
}
|
|
|
|
ctx := auth.WithAuthContext(r.Context(), auth.AuthContext{
|
|
TeamID: claims.TeamID,
|
|
UserID: claims.Subject,
|
|
Email: claims.Email,
|
|
Role: claims.Role,
|
|
})
|
|
next.ServeHTTP(w, r.WithContext(ctx))
|
|
})
|
|
}
|
|
}
|