internal/middleware/auth.go - master - foult080/hackaton-app

internal/middleware/auth.go
115 строк3 KB
Foult080
refactor(): migrate to golang
07 июл 2026, 09:37
07 июл 2026, 09:37dc52ff5
package middleware

import (
	"context"
	"encoding/json"
	"net/http"
	"strings"

	"github.com/golang-jwt/jwt/v5"
)

type userClaims struct {
	ID   string `json:"id"`
	Role string `json:"role"`
}

type contextKey string

const userKey contextKey = "user"

func Auth(secret string) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			tokenStr := r.Header.Get("x-auth-token")
			if tokenStr == "" {
				writeJSON(w, http.StatusUnauthorized, map[string]interface{}{
					"success": false,
					"error":   map[string]string{"message": "No token, authorization denied"},
				})
				return
			}

			token, err := jwt.Parse(tokenStr, func(t *jwt.Token) (interface{}, error) {
				return []byte(secret), nil
			}, jwt.WithValidMethods([]string{"HS256"}))

			if err != nil || !token.Valid {
				writeJSON(w, http.StatusUnauthorized, map[string]interface{}{
					"success": false,
					"error":   map[string]string{"message": "Token is not valid"},
				})
				return
			}

			claims, ok := token.Claims.(jwt.MapClaims)
			if !ok {
				writeJSON(w, http.StatusUnauthorized, map[string]interface{}{
					"success": false,
					"error":   map[string]string{"message": "Token is not valid"},
				})
				return
			}

			userRaw, ok := claims["user"]
			if !ok {
				writeJSON(w, http.StatusUnauthorized, map[string]interface{}{
					"success": false,
					"error":   map[string]string{"message": "Token is not valid"},
				})
				return
			}

			userMap, ok := userRaw.(map[string]interface{})
			if !ok {
				writeJSON(w, http.StatusUnauthorized, map[string]interface{}{
					"success": false,
					"error":   map[string]string{"message": "Token is not valid"},
				})
				return
			}

			id, _ := userMap["id"].(string)
			role, _ := userMap["role"].(string)

			ctx := context.WithValue(r.Context(), userKey, &userClaims{ID: id, Role: role})
			next.ServeHTTP(w, r.WithContext(ctx))
		})
	}
}

func GetUser(ctx context.Context) *userClaims {
	u, _ := ctx.Value(userKey).(*userClaims)
	return u
}

func RequireRole(roles ...string) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			u := GetUser(r.Context())
			if u == nil {
				writeJSON(w, http.StatusUnauthorized, map[string]interface{}{
					"success": false,
					"error":   map[string]string{"message": "Not authenticated"},
				})
				return
			}
			for _, role := range roles {
				if strings.EqualFold(u.Role, role) {
					next.ServeHTTP(w, r)
					return
				}
			}
			writeJSON(w, http.StatusForbidden, map[string]interface{}{
				"success": false,
				"error":   map[string]string{"message": "Access denied"},
			})
		})
	}
}

func writeJSON(w http.ResponseWriter, status int, data interface{}) {
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(status)
	json.NewEncoder(w).Encode(data)
}