emilandClaude Sonnet 4.6
50b3c4198a
- Go backend: auth (JWT), points earn/spend, QR token generation, partners, admin grant/stats endpoints with chi router - Next.js 14 frontend: login, student dashboard, transaction history, QR display, partners list - PostgreSQL migrations (4 tables), Redis cache, Docker Compose - CORS middleware, role-based route protection, Zustand auth store Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
23 lines
668 B
Go
23 lines
668 B
Go
package middleware
|
|
|
|
import "net/http"
|
|
|
|
// RequireRole returns middleware that allows only requests whose authenticated user
|
|
// holds one of the permitted roles. Must be chained after Auth middleware.
|
|
func RequireRole(allowed ...string) func(http.Handler) http.Handler {
|
|
set := make(map[string]struct{}, len(allowed))
|
|
for _, r := range allowed {
|
|
set[r] = struct{}{}
|
|
}
|
|
|
|
return func(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if _, ok := set[UserRoleFromContext(r.Context())]; !ok {
|
|
http.Error(w, `{"error":"forbidden"}`, http.StatusForbidden)
|
|
return
|
|
}
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
}
|