0a0ec016d8
Backend: - auth/permissions.go: full permission matrix with RequirePermission/RequireRole middleware, CanEditCase, CanDeleteDocument helpers - auth/context.go: add user role to request context - auth/middleware.go: resolve role alongside tenant in auth flow - auth/tenant_resolver.go: verify membership + resolve role for X-Tenant-ID - handlers/case_assignments.go: CRUD for case-level user assignments - handlers/tenant_handler.go: UpdateMemberRole, GetMe (/api/me) endpoints - handlers/documents.go: permission-based delete (own vs all) - router/router.go: permission-wrapped routes for all endpoints - services/case_assignment_service.go: assign/unassign with tenant validation - services/tenant_service.go: UpdateMemberRole with owner protection - models/case_assignment.go: CaseAssignment model Database: - user_tenants.role: CHECK constraint (owner/partner/associate/paralegal/secretary) - case_assignments table: case_id, user_id, role (lead/team/viewer) - Migrated existing admin->partner, member->associate Frontend: - usePermissions hook: fetches /api/me, provides can() helper - TeamSettings: 5-role dropdown, role change, permission-gated invite - CaseAssignments: new component for case-level team management - Sidebar: conditionally hides AI/Settings based on permissions - Cases page: hides "Neue Akte" button for non-authorized roles - Case detail: new "Mitarbeiter" tab for assignment management
107 lines
2.5 KiB
Go
107 lines
2.5 KiB
Go
package auth
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/golang-jwt/jwt/v5"
|
|
"github.com/google/uuid"
|
|
"github.com/jmoiron/sqlx"
|
|
)
|
|
|
|
type Middleware struct {
|
|
jwtSecret []byte
|
|
db *sqlx.DB
|
|
}
|
|
|
|
func NewMiddleware(jwtSecret string, db *sqlx.DB) *Middleware {
|
|
return &Middleware{jwtSecret: []byte(jwtSecret), db: db}
|
|
}
|
|
|
|
func (m *Middleware) RequireAuth(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
token := extractBearerToken(r)
|
|
if token == "" {
|
|
http.Error(w, "missing authorization token", http.StatusUnauthorized)
|
|
return
|
|
}
|
|
|
|
userID, err := m.verifyJWT(token)
|
|
if err != nil {
|
|
http.Error(w, fmt.Sprintf("invalid token: %v", err), http.StatusUnauthorized)
|
|
return
|
|
}
|
|
|
|
ctx := ContextWithUserID(r.Context(), userID)
|
|
|
|
// Resolve tenant and role from user_tenants
|
|
var membership struct {
|
|
TenantID uuid.UUID `db:"tenant_id"`
|
|
Role string `db:"role"`
|
|
}
|
|
err = m.db.GetContext(r.Context(), &membership,
|
|
"SELECT tenant_id, role FROM user_tenants WHERE user_id = $1 LIMIT 1", userID)
|
|
if err != nil {
|
|
http.Error(w, "no tenant found for user", http.StatusForbidden)
|
|
return
|
|
}
|
|
ctx = ContextWithTenantID(ctx, membership.TenantID)
|
|
ctx = ContextWithUserRole(ctx, membership.Role)
|
|
|
|
next.ServeHTTP(w, r.WithContext(ctx))
|
|
})
|
|
}
|
|
|
|
func (m *Middleware) verifyJWT(tokenStr string) (uuid.UUID, error) {
|
|
parsedToken, err := jwt.Parse(tokenStr, func(t *jwt.Token) (interface{}, error) {
|
|
if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
|
|
return nil, fmt.Errorf("unexpected signing method: %v", t.Header["alg"])
|
|
}
|
|
return m.jwtSecret, nil
|
|
})
|
|
if err != nil {
|
|
return uuid.Nil, fmt.Errorf("parsing JWT: %w", err)
|
|
}
|
|
|
|
if !parsedToken.Valid {
|
|
return uuid.Nil, fmt.Errorf("invalid JWT token")
|
|
}
|
|
|
|
claims, ok := parsedToken.Claims.(jwt.MapClaims)
|
|
if !ok {
|
|
return uuid.Nil, fmt.Errorf("extracting JWT claims")
|
|
}
|
|
|
|
if exp, ok := claims["exp"].(float64); ok {
|
|
if time.Now().Unix() > int64(exp) {
|
|
return uuid.Nil, fmt.Errorf("JWT token has expired")
|
|
}
|
|
}
|
|
|
|
sub, ok := claims["sub"].(string)
|
|
if !ok {
|
|
return uuid.Nil, fmt.Errorf("missing sub claim in JWT")
|
|
}
|
|
|
|
userID, err := uuid.Parse(sub)
|
|
if err != nil {
|
|
return uuid.Nil, fmt.Errorf("invalid user ID format: %w", err)
|
|
}
|
|
|
|
return userID, nil
|
|
}
|
|
|
|
func extractBearerToken(r *http.Request) string {
|
|
auth := r.Header.Get("Authorization")
|
|
if auth == "" {
|
|
return ""
|
|
}
|
|
parts := strings.SplitN(auth, " ", 2)
|
|
if len(parts) != 2 || !strings.EqualFold(parts[0], "bearer") {
|
|
return ""
|
|
}
|
|
return parts[1]
|
|
}
|