I am batman

api-gateway/internal/middlewares/jwt.go

@@ -0,0 +1,50 @@
+package middlewares
+
+import (
+	"context"
+	"strings"
+
+	"go-microservices/api-gateway/internal/clients"
+	pb "go-microservices/proto/auth"
+
+	"github.com/gofiber/fiber/v2"
+)
+
+// JWTMiddleware returns a Fiber middleware that validates JWT via the auth service gRPC.
+func JWTMiddleware(authClient *clients.AuthClient) fiber.Handler {
+	return func(c *fiber.Ctx) error {
+		// Try to get Authorization header (Fiber handles case-insensitivity)
+		authHeader := c.Get("Authorization")
+		var token string
+
+		if authHeader != "" {
+			parts := strings.Split(authHeader, " ")
+			if len(parts) == 2 && parts[0] == "Bearer" {
+				token = parts[1]
+			}
+		}
+
+		// Fallback to cookie if no Bearer token found
+		if token == "" {
+			token = c.Cookies("access_token")
+		}
+
+		if token == "" {
+			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "missing token"})
+		}
+
+		// Validate token via gRPC
+		resp, err := authClient.ValidateToken(context.Background(), &pb.ValidateTokenRequest{Token: token})
+		if err != nil {
+			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "token validation failed"})
+		}
+
+		if !resp.Valid {
+			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "invalid token"})
+		}
+
+		c.Locals("userID", resp.UserId)
+
+		return c.Next()
+	}
+}

api-gateway/internal/middlewares/roles.go

@@ -0,0 +1,36 @@
+package middlewares
+
+import (
+	"github.com/gofiber/fiber/v2"
+	"gorm.io/gorm"
+)
+
+func OnlyAdmin(db *gorm.DB, fn fiber.Handler) fiber.Handler {
+	return func(c *fiber.Ctx) error {
+		role, ok := c.Locals("userRole").(string)
+		if !ok || role != "Admin" {
+			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "Access denied"})
+		}
+		return fn(c)
+	}
+}
+
+func OnlyModerator(db *gorm.DB, fn fiber.Handler) fiber.Handler {
+	return func(c *fiber.Ctx) error {
+		role, ok := c.Locals("userRole").(string)
+		if !ok || (role != "Moderator" && role != "Admin") {
+			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "Access denied"})
+		}
+		return fn(c)
+	}
+}
+
+func OnlyUser(db *gorm.DB, fn fiber.Handler) fiber.Handler {
+	return func(c *fiber.Ctx) error {
+		role, ok := c.Locals("userRole").(string)
+		if !ok || role != "User" {
+			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "Access denied"})
+		}
+		return fn(c)
+	}
+}