Issue 4 jwt (#24)

server/middleware/auth.go

@@ -11,10 +11,11 @@ import (
 	"git.gobha.me/xcaliber/chat-switchboard/database"
 )
 
-// Claims represents the JWT payload.
+// Claims represents the JWT payload. Must match handlers.Claims.
 type Claims struct {
 	UserID string `json:"user_id"`
 	Email  string `json:"email"`
+	Role   string `json:"role"`
 	jwt.RegisteredClaims
 }
 
@@ -63,6 +64,22 @@ func Auth(cfg *config.Config) gin.HandlerFunc {
 		// Store claims in context for downstream handlers
 		c.Set("user_id", claims.UserID)
 		c.Set("email", claims.Email)
+		c.Set("role", claims.Role)
 		c.Next()
 	}
-}
+}
+
+// CORS returns a middleware that sets cross-origin headers.
+// NOTE: If you have a separate cors.go, delete it — CORS lives here only.
+func CORS() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.Header("Access-Control-Allow-Origin", "*")
+		c.Header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
+		c.Header("Access-Control-Allow-Headers", "Content-Type, Authorization")
+		if c.Request.Method == "OPTIONS" {
+			c.AbortWithStatus(http.StatusNoContent)
+			return
+		}
+		c.Next()
+	}
+}