Changeset 0.29.2 (#197)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/middleware/page_auth.go

@@ -55,14 +55,29 @@ func AuthOrRedirect(cfg *config.Config, users store.UserStore, cache *UserStatus
 			return
 		}
 
-		// Verify user is active and resolve current role from DB
-		role, valid := verifyUser(c, claims, users, cache)
-		if !valid {
-			// verifyUser sent a JSON error, but for page routes we want a redirect.
-			// The abort already happened, so just return.
+		if claims.UserID == "" {
+			redirectToLogin(c, loginPath)
 			return
 		}
 
+		// Resolve user role — redirect (not JSON) on any failure.
+		var role string
+		if entry, hit := cache.get(claims.UserID); hit {
+			if !entry.isActive {
+				redirectToLogin(c, loginPath)
+				return
+			}
+			role = entry.role
+		} else {
+			user, err := users.GetByID(c.Request.Context(), claims.UserID)
+			if err != nil || !user.IsActive {
+				redirectToLogin(c, loginPath)
+				return
+			}
+			cache.set(claims.UserID, user.IsActive, user.Role)
+			role = user.Role
+		}
+
 		c.Set("user_id", claims.UserID)
 		c.Set("email", claims.Email)
 		c.Set("role", role)