feat: protect write endpoints with JWT auth (story #08) #8

2026-06-19T09:19:41Z

julia commented

2026-06-19 09:19:41 +00:00

Summary

Add backend/internal/auth package: bcrypt verify (username:password pepper), JWT generate/validate (HS256, 1h expiry)
JWT middleware applied to all POST/PUT/DELETE routes; admin group gets group-level middleware
POST /api/v1/auth/login endpoint reads user map from USERS_FILE env
Pinia authStore persists JWT in localStorage; bearerHeader() / handleUnauthorized() shared by all API modules
LoginView with redirect-after-login support; router guard on /fruits/new, /publications/new, /admin
v-if="auth.isLoggedIn" guards on all CRUD buttons and admin nav link
scripts/create_user.sh generates bcrypt hash entries for users.env

Test plan

make test passes (Go auth/middleware/handler tests + Vitest authStore tests)
Unauthenticated user: CRUD buttons hidden, write API returns 401
Login with valid credentials → redirected to original destination
Invalid credentials → error message shown
JWT expiry → auto-logout on next write attempt
Admin nav link visible only when logged in

🤖 Generated with Claude Code

## Summary - Add `backend/internal/auth` package: bcrypt verify (username:password pepper), JWT generate/validate (HS256, 1h expiry) - JWT middleware applied to all POST/PUT/DELETE routes; admin group gets group-level middleware - `POST /api/v1/auth/login` endpoint reads user map from `USERS_FILE` env - Pinia `authStore` persists JWT in localStorage; `bearerHeader()` / `handleUnauthorized()` shared by all API modules - `LoginView` with redirect-after-login support; router guard on `/fruits/new`, `/publications/new`, `/admin` - `v-if="auth.isLoggedIn"` guards on all CRUD buttons and admin nav link - `scripts/create_user.sh` generates bcrypt hash entries for `users.env` ## Test plan - [ ] `make test` passes (Go auth/middleware/handler tests + Vitest authStore tests) - [ ] Unauthenticated user: CRUD buttons hidden, write API returns 401 - [ ] Login with valid credentials → redirected to original destination - [ ] Invalid credentials → error message shown - [ ] JWT expiry → auto-logout on next write attempt - [ ] Admin nav link visible only when logged in 🤖 Generated with [Claude Code](https://claude.com/claude-code)

julia added 1 commit 2026-06-19 09:19:42 +00:00

feat: protect write endpoints with JWT auth (story #08 ) 1b381d9385

Add bcrypt user file auth, JWT middleware on all write routes, Pinia
authStore with localStorage persistence, login view with redirect
support, and v-if guards on all CRUD controls and admin nav link.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

julia merged commit d35da524e9 into feature/07-improve-fruit-overview

2026-06-19 10:04:12 +00:00

julia referenced this issue from a commit

2026-06-19 10:04:13 +00:00

feat: protect write endpoints with JWT auth (story #08)

julia referenced this pull request

2026-06-19 10:05:46 +00:00

feat: protect write endpoints with JWT auth (story #08) #9

julia referenced this issue from a commit

2026-06-19 10:10:22 +00:00

Merge pull request 'feat: protect write endpoints with JWT auth (story #08)' (#9) from feature/08-authorize-user into main

Sign in to join this conversation.