feat: user_rework (todo -> GetAll)

cmd/api/middleware.go

@@ -5,6 +5,7 @@ import (
 	"encoding/base64"
 	"errors"
 	"fmt"
+	"log"
 	"net/http"
 	"strconv"
 	"strings"
@@ -104,17 +105,20 @@ func (api *api) postsContextMiddleware(next http.Handler) http.Handler {
 			api.badRequestError(w, r, err)
 			return
 		}
+
 		ctx := r.Context()
 
 		post, err := api.store.Posts.GetByID(ctx, id)
+		log.Println("post", post)
 		if err != nil {
 			switch {
 			case errors.Is(err, store.ErrNotFound):
 				api.notFoundError(w, r, err)
+				return
 			default:
 				api.internalServerError(w, r, err)
+				return
 			}
-			return
 		}
 
 		ctx = context.WithValue(ctx, postCtx, post)
@@ -161,6 +165,27 @@ func (api *api) checkProfileOwnership(next http.HandlerFunc) http.HandlerFunc {
 	})
 }
 
+func (api *api) protectAdminRoutes(requiredRole string, next http.HandlerFunc) http.HandlerFunc {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		user := getUserFromContext(r)
+		allowed, err := api.checkRolePrecedence(r.Context(), user, requiredRole)
+		if err != nil {
+			api.internalServerError(w, r, err)
+			return
+		}
+
+		if !allowed {
+			api.forbiddenError(w, r, fmt.Errorf("forbidden"))
+			return
+		}
+
+		ctx := r.Context()
+
+		ctx = context.WithValue(ctx, roleContextKey, user.Role)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
 func (api *api) checkRolePrecedence(ctx context.Context, user *store.User, roleName string) (bool, error) {
 	role, err := api.store.Roles.GetByName(ctx, roleName)
 	if err != nil {