add(api): api endpoint authorized Bearer token

1 files changed, 29 insertions, 23 deletions

diff --git a/cmd/server/main.go b/cmd/server/main.go
index a12b278..098f6b2 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -40,31 +40,31 @@ func main() {
 	mux := http.NewServeMux()
 
 	// --- Static file serving ---
-	// The assets path must end with a slash for http.StripPrefix to work correctly.
 	assetsPath := config.Paths.Assets + "/"
 	assetsFS := http.FileServer(http.Dir("templates"))
 	mux.Handle(assetsPath, http.StripPrefix(assetsPath, assetsFS))
 
 	// --- Public Auth Routes ---
 	rateLimiter := middleware.NewRateLimiter()
-	// Auth API endpoints
-	mux.HandleFunc(config.Paths.Login, handlers.LoginHandler) // GET serves HTML, POST handles login
-	mux.Handle(config.Paths.Register, rateLimiter.RateLimitMiddleware(http.HandlerFunc(handlers.RegisterHandler))) // GET serves HTML, POST handles registration
+	mux.HandleFunc(config.Paths.Login, handlers.LoginHandler)
+	mux.Handle(config.Paths.Register, middleware.RateLimitMiddleware(rateLimiter)(http.HandlerFunc(handlers.RegisterHandler)))
 	mux.HandleFunc(config.Paths.Logout, handlers.LogoutHandler)
+	mux.HandleFunc("/auth/refresh", handlers.RefreshTokenHandler)
+	mux.HandleFunc("/api/auth/token", handlers.TokenHandler)
 
-	// Auth HTML pages
-	mux.Handle(config.Paths.Account, middleware.AuthMiddleware(http.HandlerFunc(handlers.AccountPageHandler)))
-	mux.Handle(config.Paths.Admin, middleware.AuthMiddleware(middleware.AdminMiddleware(http.HandlerFunc(handlers.AdminPageHandler))))
-	mux.Handle(config.Paths.AccountPassword, middleware.AuthMiddleware(http.HandlerFunc(handlers.ChangePasswordHandler))) // GET serves HTML, POST handles password change
+	// --- Auth HTML pages (Protected by SessionAuth) ---
+	mux.Handle(config.Paths.Account, middleware.SessionAuth(http.HandlerFunc(handlers.AccountPageHandler)))
+	mux.Handle(config.Paths.Admin, middleware.SessionAuth(middleware.AdminMiddleware(http.HandlerFunc(handlers.AdminPageHandler))))
+	mux.Handle(config.Paths.AccountPassword, middleware.SessionAuth(http.HandlerFunc(handlers.ChangePasswordHandler)))
 
-	// --- Protected API Endpoints ---
+	// --- Protected API Endpoints (for Admin UI, protected by SessionAuth) ---
 	adminUsersAPI := http.HandlerFunc(handlers.GetUsersHandler)
 	adminUpdateRoleAPI := http.HandlerFunc(handlers.UpdateUserRoleHandler)
 	adminDeleteUserAPI := http.HandlerFunc(handlers.DeleteUserHandler)
 	adminSetStatusAPI := http.HandlerFunc(handlers.SetUserActiveStatusHandler)
 
-	mux.Handle(config.Paths.AdminUsersAPI, middleware.AuthMiddleware(middleware.AdminMiddleware(adminUsersAPI)))
-	mux.Handle(config.Paths.AdminUsersAPI+"/", middleware.AuthMiddleware(middleware.AdminMiddleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	mux.Handle(config.Paths.AdminUsersAPI, middleware.SessionAuth(middleware.AdminMiddleware(adminUsersAPI)))
+	mux.Handle(config.Paths.AdminUsersAPI+"/", middleware.SessionAuth(middleware.AdminMiddleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		path := r.URL.Path
 		switch {
 		case strings.HasSuffix(path, "/role") && r.Method == http.MethodPost:
@@ -79,25 +79,31 @@ func main() {
 	}))))
 
 	// --- Main Application Proxy ---
-	// All other requests are sent to the proxy. The final handler below will wrap them
-	// with the authentication middleware.
 	proxyHandler := handlers.NewProxy(targetURL)
-	authedProxy := middleware.AuthMiddleware(proxyHandler)
 
-	// finalHandler wraps the mux. If a route is not explicitly defined in the mux,
-	// it falls through to the authenticated proxy. This prevents the login page
-	// from being caught by the authentication middleware, fixing the redirect loop.
 	finalHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// Check if a handler is registered for the path in the mux.
-		// The returned pattern will be empty if no handler matches.
 		_, pattern := mux.Handler(r)
 		if pattern != "" {
-			// A specific route was matched (e.g., /login, /admin, /assets/). Serve it.
 			mux.ServeHTTP(w, r)
-		} else {
-			// No specific route was matched. Use the authenticated proxy.
-			authedProxy.ServeHTTP(w, r)
+			return
 		}
+
+		path := r.URL.Path
+
+		// API Protection with Bearer Token
+		if config.Paths.ProtectAPI && strings.HasPrefix(path, config.Paths.APIPath) {
+			middleware.BearerAuth(proxyHandler).ServeHTTP(w, r)
+			return
+		}
+
+		// Frontend Protection with Session Cookie
+		if config.Paths.ProtectFrontend {
+			middleware.SessionAuth(proxyHandler).ServeHTTP(w, r)
+			return
+		}
+
+		// No protection
+		proxyHandler.ServeHTTP(w, r)
 	})
 
 	// --- Start Server ---