vikingowl
580b9d5e3c
- Admin CRUD endpoints for markets with role-based middleware - Anonymous market submission with Cloudflare Turnstile verification - SMTP email notifications on new submissions (LogSender fallback) - Market status workflow (pending/approved/rejected) with admin notes - Nullable location column for submissions without coordinates - CLI tool for promoting users to admin role - Slug generation package extracted from seed - Rate limiting on submission endpoint (3/hour per IP) - Mailpit added to docker-compose for local email testing
27 lines
558 B
Go
27 lines
558 B
Go
package middleware
|
|
|
|
import (
|
|
"github.com/gin-gonic/gin"
|
|
|
|
"marktvogt.de/backend/internal/pkg/apierror"
|
|
)
|
|
|
|
func RequireRole(roles ...string) gin.HandlerFunc {
|
|
allowed := make(map[string]struct{}, len(roles))
|
|
for _, r := range roles {
|
|
allowed[r] = struct{}{}
|
|
}
|
|
|
|
return func(c *gin.Context) {
|
|
role, _ := c.Get("user_role")
|
|
roleStr, _ := role.(string)
|
|
|
|
if _, ok := allowed[roleStr]; !ok {
|
|
apiErr := apierror.Forbidden("insufficient permissions")
|
|
c.AbortWithStatusJSON(apiErr.Status, apierror.NewResponse(apiErr))
|
|
return
|
|
}
|
|
c.Next()
|
|
}
|
|
}
|