MichilisandCursor
c9a600b6d6
Introduces the Go photo-api service, nginx/systemd deploy wiring, and Next.js gallery/lightbox pages so event photos can be managed and browsed. Co-authored-by: Cursor <cursoragent@cursor.com>
37 lines
1011 B
Go
37 lines
1011 B
Go
package httpapi
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"git.azzamo.net/Michilis/Spanglish/photo-api/internal/auth"
|
|
)
|
|
|
|
// requireAdmin mirrors the backend's requireAuth(['admin','organizer']):
|
|
// 401 {"error":"Unauthorized"} without a valid token, 403
|
|
// {"error":"Forbidden"} for valid non-admin users.
|
|
func (s *Server) requireAdmin(next func(http.ResponseWriter, *http.Request, auth.User)) http.HandlerFunc {
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
user, err := s.verifier.FromRequest(r)
|
|
if err != nil {
|
|
writeError(w, http.StatusUnauthorized, "Unauthorized")
|
|
return
|
|
}
|
|
if !user.IsAdmin() {
|
|
writeError(w, http.StatusForbidden, "Forbidden")
|
|
return
|
|
}
|
|
next(w, r, user)
|
|
}
|
|
}
|
|
|
|
// optionalUser returns the authenticated user or nil; an invalid token is
|
|
// treated as anonymous rather than an error, matching how public backend
|
|
// routes behave.
|
|
func (s *Server) optionalUser(r *http.Request) *auth.User {
|
|
user, err := s.verifier.FromRequest(r)
|
|
if err != nil {
|
|
return nil
|
|
}
|
|
return &user
|
|
}
|