fix: resolve context key cycle for admin check

api/admin/handler.go

@@ -11,6 +11,7 @@ import (
 	"mal/api/auth"
 	"mal/internal/db"
 	"mal/internal/middleware"
+	webcontext "mal/web/context"
 	"mal/web/templates"
 )
 
@@ -166,7 +167,7 @@ func GetImpersonatedUserID(r *http.Request) string {
 	}
 
 	// Verify the current user is admin
-	user, ok := r.Context().Value(middleware.UserContextKey).(*database.User)
+	user, ok := r.Context().Value(webcontext.UserKey).(*database.User)
 	if !ok || user == nil || !middleware.IsAdmin(user) {
 		return ""
 	}

api/anime/handler.go

@@ -12,7 +12,7 @@ import (
 
 	"mal/integrations/jikan"
 	"mal/internal/db"
-	"mal/internal/middleware"
+	webcontext "mal/web/context"
 	animecomponents "mal/web/components/anime"
 	watchcomponents "mal/web/components/watch"
 	"mal/web/templates"
@@ -65,7 +65,7 @@ func parsePageParam(r *http.Request) int {
 }
 
 func userIDFromRequest(r *http.Request) string {
-	user, ok := r.Context().Value(middleware.UserContextKey).(*database.User)
+	user, ok := r.Context().Value(webcontext.UserKey).(*database.User)
 	if !ok || user == nil {
 		return ""
 	}

api/playback/handler.go

@@ -17,6 +17,7 @@ import (
 	"mal/integrations/jikan"
 	"mal/internal/db"
 	"mal/internal/middleware"
+	webcontext "mal/web/context"
 	"mal/web/components/watch"
 	"mal/web/shared"
 	"mal/web/templates"
@@ -131,7 +132,7 @@ func (h *Handler) HandleWatchPage(w http.ResponseWriter, r *http.Request) {
 }
 
 func watchlistUserIDFromRequest(r *http.Request) string {
-	user, ok := r.Context().Value(middleware.UserContextKey).(*database.User)
+	user, ok := r.Context().Value(webcontext.UserKey).(*database.User)
 	if !ok || user == nil {
 		return ""
 	}

internal/middleware/access.go

@@ -5,6 +5,7 @@ import (
 	"strings"
 
 	"mal/internal/db"
+	webcontext "mal/web/context"
 )
 
 type AccessPolicy struct {
@@ -46,7 +47,7 @@ func RequireGlobalAuthWithPolicy(policy AccessPolicy) func(http.Handler) http.Ha
 				return
 			}
 
-			user, ok := r.Context().Value(UserContextKey).(*database.User)
+			user, ok := r.Context().Value(webcontext.UserKey).(*database.User)
 			if !ok || user == nil {
 				if strings.HasPrefix(r.URL.Path, "/api/") || r.Header.Get("HX-Request") == "true" {
 					w.Header().Set("HX-Redirect", "/login")

internal/middleware/admin.go

@@ -4,6 +4,7 @@ import (
 	"net/http"
 
 	"mal/internal/db"
+	webcontext "mal/web/context"
 	"mal/web/shared/admin"
 )
 
@@ -13,7 +14,7 @@ func IsAdmin(user *database.User) bool {
 
 func RequireAdmin(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		user, ok := r.Context().Value(UserContextKey).(*database.User)
+		user, ok := r.Context().Value(webcontext.UserKey).(*database.User)
 		if !ok || user == nil {
 			http.Redirect(w, r, "/login", http.StatusFound)
 			return

internal/middleware/auth.go

@@ -7,12 +7,7 @@ import (
 
 	"mal/api/auth"
 	"mal/internal/db"
-)
+	webcontext "mal/web/context"
-
-type contextKey string
-
-const (
-	UserContextKey contextKey = "user"
 )
 
 func Auth(authService *auth.Service) func(http.Handler) http.Handler {
@@ -20,20 +15,17 @@ func Auth(authService *auth.Service) func(http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			cookie, err := r.Cookie("session_id")
 			if err != nil {
-				// No session cookie, user is unauthenticated. Proceed, but not logged in.
 				next.ServeHTTP(w, r)
 				return
 			}
 
 			user, err := authService.ValidateSession(r.Context(), cookie.Value)
 			if err != nil {
-				// Invalid session, proceed as unauthenticated
 				next.ServeHTTP(w, r)
 				return
 			}
 
-			// Valid session, bind user to context
+			ctx := context.WithValue(r.Context(), webcontext.UserKey, user)
-			ctx := context.WithValue(r.Context(), UserContextKey, user)
 			next.ServeHTTP(w, r.WithContext(ctx))
 		})
 	}
@@ -41,7 +33,7 @@ func Auth(authService *auth.Service) func(http.Handler) http.Handler {
 
 func RequireAuth(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		user, ok := r.Context().Value(UserContextKey).(*database.User)
+		user, ok := r.Context().Value(webcontext.UserKey).(*database.User)
 		if !ok || user == nil {
 			if strings.HasPrefix(r.URL.Path, "/api/") {
 				w.Header().Set("HX-Redirect", "/login")
@@ -56,9 +48,9 @@ func RequireAuth(next http.Handler) http.Handler {
 }
 
 func GetUser(ctx context.Context) *database.User {
-	user, ok := ctx.Value(UserContextKey).(*database.User)
+	user, ok := ctx.Value(webcontext.UserKey).(*database.User)
 	if !ok {
 		return nil
 	}
 	return user
-}
+}

web/context/context.go

@@ -0,0 +1,3 @@
+package context
+
+const UserKey = "mal:user"

web/shared/admin/admin.go

@@ -1,15 +1,9 @@
 package admin
 
 import (
-	"context"
-
 	"mal/internal/db"
 )
 
-type contextKey string
-
-const userContextKey contextKey = "user"
-
 const AdminEmail = "mikkelelvers@outlook.com"
 
 func IsAdmin(user *database.User) bool {
@@ -19,14 +13,8 @@ func IsAdmin(user *database.User) bool {
 	return user.Username == AdminEmail
 }
 
-func GetUser(ctx context.Context) *database.User {
+func IsAdminFromContext(ctx interface{ Value(key interface{}) interface{} }) bool {
-	user, ok := ctx.Value(userContextKey).(*database.User)
+	const userKey = "mal:user"
-	if !ok {
+	user, _ := ctx.Value(userKey).(*database.User)
-		return nil
+	return IsAdmin(user)
-	}
+}
-	return user
-}
-
-func IsAdminFromContext(ctx context.Context) bool {
-	return IsAdmin(GetUser(ctx))
-}