julia/osdb-1-claude-opusplan
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: protect write endpoints with JWT auth (story #08)

Browse Source 
Add bcrypt user file auth, JWT middleware on all write routes, Pinia
authStore with localStorage persistence, login view with redirect
support, and v-if guards on all CRUD controls and admin nav link.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
julia
2026-06-19 11:18:42 +02:00
co-authored by Claude Sonnet 4.6
parent 649c9687ac
commit 1b381d9385
32 changed files with 895 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/cmd/server/router.go
+26 -19
View File
@@ -6,17 +6,20 @@ import (
"github.com/labstack/echo/v4/middleware"
"osdb/internal/handler"
mw "osdb/internal/middleware"
"osdb/internal/repository"
)
// New creates and configures the Echo instance with all routes registered.
func New(pool *pgxpool.Pool) *echo.Echo {
func New(pool *pgxpool.Pool, users map[string]string, jwtSecret string) *echo.Echo {
e := echo.New()
e.HideBanner = true
e.Use(middleware.Logger())
e.Use(middleware.Recover())
jwtAuth := mw.JWTAuth(jwtSecret)
health := handler.NewHealthHandler()
// Root health — used by docker healthcheck + ops tooling
@@ -26,21 +29,25 @@ func New(pool *pgxpool.Pool) *echo.Echo {
api := e.Group("/api/v1")
api.GET("/health", health.Health)
// Auth (story #08)
authHandler := handler.NewAuthHandler(users, jwtSecret)
api.POST("/auth/login", authHandler.Login)
// Fruits (story #02)
fruitRepo := repository.NewFruitRepo(pool)
fruits := handler.NewFruitHandler(fruitRepo)
g := api.Group("/fruits")
g.GET("", fruits.List)
g.POST("", fruits.Create)
g.POST("", fruits.Create, jwtAuth)
g.GET("/:id", fruits.Get)
g.PUT("/:id", fruits.Update)
g.DELETE("/:id", fruits.Delete)
g.PUT("/:id", fruits.Update, jwtAuth)
g.DELETE("/:id", fruits.Delete, jwtAuth)
g.GET("/:id/images", fruits.ListImages)
g.POST("/:id/images", fruits.UploadImage, middleware.BodyLimit("5M"))
g.POST("/:id/images", fruits.UploadImage, jwtAuth, middleware.BodyLimit("5M"))
g.GET("/:id/images/:imageId", fruits.ServeImage)
g.GET("/:id/images/:imageId/thumbnail", fruits.ServeThumbnail)
g.DELETE("/:id/images/:imageId", fruits.DeleteImage)
g.DELETE("/:id/images/:imageId", fruits.DeleteImage, jwtAuth)
// Publications (story #04)
pubRepo := repository.NewPublicationRepo(pool)
@@ -52,29 +59,29 @@ func New(pool *pgxpool.Pool) *echo.Echo {
p := api.Group("/publications")
p.GET("", pubs.List)
p.POST("", pubs.Create)
p.POST("", pubs.Create, jwtAuth)
p.GET("/:id", pubs.Get)
p.PUT("/:id", pubs.Update)
p.DELETE("/:id", pubs.Delete)
p.POST("/:id/image", pubs.UploadCoverImage, middleware.BodyLimit("5M"))
p.PUT("/:id", pubs.Update, jwtAuth)
p.DELETE("/:id", pubs.Delete, jwtAuth)
p.POST("/:id/image", pubs.UploadCoverImage, jwtAuth, middleware.BodyLimit("5M"))
p.GET("/:id/image", pubs.ServeCoverImage)
p.DELETE("/:id/image", pubs.DeleteCoverImage)
p.DELETE("/:id/image", pubs.DeleteCoverImage, jwtAuth)
p.GET("/:id/fruits", pubs.ListFruits)
p.POST("/:id/fruits", pubs.LinkFruit)
p.DELETE("/:id/fruits/:fruitId", pubs.UnlinkFruit)
p.POST("/:id/fruits", pubs.LinkFruit, jwtAuth)
p.DELETE("/:id/fruits/:fruitId", pubs.UnlinkFruit, jwtAuth)
p.GET("/:id/descriptions", pubs.ListDescriptions)
p.POST("/:id/descriptions", pubs.UploadDescription, middleware.BodyLimit("5M"))
p.POST("/:id/descriptions", pubs.UploadDescription, jwtAuth, middleware.BodyLimit("5M"))
p.GET("/:id/descriptions/:descId", pubs.ServeDescription)
p.DELETE("/:id/descriptions/:descId", pubs.DeleteDescription)
p.DELETE("/:id/descriptions/:descId", pubs.DeleteDescription, jwtAuth)
p.GET("/:id/fruit-images", pubs.ListFruitImages)
p.POST("/:id/fruit-images", pubs.UploadFruitImage, middleware.BodyLimit("5M"))
p.POST("/:id/fruit-images", pubs.UploadFruitImage, jwtAuth, middleware.BodyLimit("5M"))
p.GET("/:id/fruit-images/:imgId", pubs.ServeFruitImage)
p.GET("/:id/fruit-images/:imgId/thumbnail", pubs.ServeFruitImageThumbnail)
p.DELETE("/:id/fruit-images/:imgId", pubs.DeleteFruitImage)
p.DELETE("/:id/fruit-images/:imgId", pubs.DeleteFruitImage, jwtAuth)
// Admin (story #07)
// Admin (story #07) — all admin routes require auth
admin := handler.NewAdminHandler(fruitRepo, pubRepo)
adminGroup := api.Group("/admin")
adminGroup := api.Group("/admin", jwtAuth)
adminGroup.POST("/backfill-thumbnails", admin.BackfillThumbnails)
return e