Changeset 0.28.4 (#190)

server/middleware/page_auth.go

@@ -6,10 +6,10 @@ import (
 	"strings"
 
 	"github.com/gin-gonic/gin"
-	"github.com/golang-jwt/jwt/v5"
 
 	"git.gobha.me/xcaliber/chat-switchboard/config"
 	"git.gobha.me/xcaliber/chat-switchboard/database"
+	"git.gobha.me/xcaliber/chat-switchboard/store"
 )
 
 // AuthOrRedirect validates JWT tokens for page routes.
@@ -18,7 +18,7 @@ import (
 //
 // Token is read from the "sb_token" cookie (set by the login page JS)
 // since page requests don't have Authorization headers.
-func AuthOrRedirect(cfg *config.Config) gin.HandlerFunc {
+func AuthOrRedirect(cfg *config.Config, users store.UserStore, cache *UserStatusCache) gin.HandlerFunc {
 	loginPath := cfg.BasePath + "/login"
 
 	return func(c *gin.Context) {
@@ -49,23 +49,23 @@ func AuthOrRedirect(cfg *config.Config) gin.HandlerFunc {
 			return
 		}
 
-		claims := &Claims{}
-		token, err := jwt.ParseWithClaims(tokenString, claims, func(t *jwt.Token) (interface{}, error) {
-			if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
-				return nil, jwt.ErrSignatureInvalid
-			}
-			return []byte(cfg.JWTSecret), nil
-		})
-
-		if err != nil || !token.Valid {
+		claims, ok := parseAndValidateJWT(tokenString, cfg.JWTSecret)
+		if !ok {
 			redirectToLogin(c, loginPath)
 			return
 		}
 
-		// Store claims in context (same as Auth middleware)
+		// Verify user is active and resolve current role from DB
+		role, valid := verifyUser(c, claims, users, cache)
+		if !valid {
+			// verifyUser sent a JSON error, but for page routes we want a redirect.
+			// The abort already happened, so just return.
+			return
+		}
+
 		c.Set("user_id", claims.UserID)
 		c.Set("email", claims.Email)
-		c.Set("role", claims.Role)
+		c.Set("role", role)
 		c.Next()
 	}
 }