refactor: move auth middleware from subdirectory

internal/auth/middleware.go

@@ -0,0 +1,113 @@
+package auth
+
+import (
+	"mal/internal/domain"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+)
+
+type publicRoute struct {
+	method string
+	path   string
+	prefix bool
+}
+
+var publicRoutes = []publicRoute{
+	// Pages.
+	{method: http.MethodGet, path: "/login"},
+	{method: http.MethodPost, path: "/login"},
+	{method: http.MethodGet, path: "/logout"},
+
+	// Static assets.
+	{path: "/static", prefix: true},
+	{path: "/dist", prefix: true},
+
+	// Observability endpoints.
+	{method: http.MethodGet, path: "/metrics"},
+
+	// Auth API.
+	{method: http.MethodPost, path: "/api/auth/login"},
+}
+
+func isPublicRequest(method string, path string) bool {
+	for _, r := range publicRoutes {
+		if r.method != "" && r.method != method {
+			continue
+		}
+		if r.prefix {
+			if strings.HasPrefix(path, r.path) {
+				return true
+			}
+			continue
+		}
+		if path == r.path {
+			return true
+		}
+	}
+	return false
+}
+
+func AuthMiddleware(svc domain.AuthService) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		path := c.Request.URL.Path
+
+		if isPublicRequest(c.Request.Method, path) {
+			c.Next()
+			return
+		}
+
+		var user *domain.User
+		var err error
+		var sessionID string
+		var usesCookieSession bool
+
+		// API routes can authenticate via Bearer token OR cookie session.
+		if strings.HasPrefix(path, "/api/") {
+			authHeader := strings.TrimSpace(c.GetHeader("Authorization"))
+			if strings.HasPrefix(strings.ToLower(authHeader), "bearer ") {
+				token := strings.TrimSpace(authHeader[7:])
+				user, err = svc.ValidateAPIToken(c.Request.Context(), token)
+			} else if cookieSessionID, cookieErr := c.Cookie("session_id"); cookieErr == nil {
+				sessionID = cookieSessionID
+				usesCookieSession = true
+				user, err = svc.ValidateSession(c.Request.Context(), sessionID)
+			} else {
+				err = cookieErr
+			}
+
+			if err != nil || user == nil {
+				c.JSON(http.StatusUnauthorized, gin.H{"error": "Unauthorized"})
+				c.Abort()
+				return
+			}
+		} else {
+			// Non-API routes only use cookie sessions and redirect to /login.
+			cookieSessionID, cookieErr := c.Cookie("session_id")
+			if cookieErr != nil {
+				c.Redirect(http.StatusSeeOther, "/login")
+				c.Abort()
+				return
+			}
+
+			sessionID = cookieSessionID
+			usesCookieSession = true
+			user, err = svc.ValidateSession(c.Request.Context(), sessionID)
+			if err != nil || user == nil {
+				c.Redirect(http.StatusSeeOther, "/login")
+				c.Abort()
+				return
+			}
+		}
+
+		if usesCookieSession {
+			if refreshErr := svc.RefreshSession(c.Request.Context(), sessionID); refreshErr == nil {
+				c.SetCookie("session_id", sessionID, int(domain.SessionLifetime.Seconds()), "/", "", false, true)
+			}
+		}
+
+		c.Set("User", user)
+		c.Next()
+	}
+}