Step 2 — Products and the admin role

1type Claims struct {
2	Role string `json:"role"`
3	jwt.RegisteredClaims
4}
5
6func (s *Service) issueToken(userID int64, role string) (string, error) {
7	claims := Claims{
8		Role: role,
9		RegisteredClaims: jwt.RegisteredClaims{
10			Subject:   strconv.FormatInt(userID, 10),
11			IssuedAt:  jwt.NewNumericDate(time.Now()),
12			ExpiresAt: jwt.NewNumericDate(time.Now().Add(15 * time.Minute)),
13		},
14	}
15	return jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString(s.secret)
16}

1package middleware
2
3type roleKey struct{}
4
5// RequireRole must run AFTER RequireAuth, which is what puts the role in the
6// context in the first place.
7func RequireRole(role string) func(http.Handler) http.Handler {
8	return func(next http.Handler) http.Handler {
9		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
10			got, ok := r.Context().Value(roleKey{}).(string)
11			if !ok {
12				// no role in the context means RequireAuth did not run
13				httpx.Error(w, 401, "unauthorized")
14				return
15			}
16			if got != role {
17				// we know who they are; they simply may not do this
18				httpx.Error(w, 403, "forbidden")
19				return
20			}
21			next.ServeHTTP(w, r)
22		})
23	}
24}

1protect := middleware.RequireAuth(cfg.JWTSecret)
2adminOnly := middleware.RequireRole("admin")
3
4// public — anyone can browse
5mux.HandleFunc("GET /v1/products", productH.List)
6mux.HandleFunc("GET /v1/products/{id}", productH.Get)
7
8// admin only — note the order: authenticate first, then check the role
9mux.Handle("POST /v1/products",
10	protect(adminOnly(http.HandlerFunc(productH.Create))))
11mux.Handle("PATCH /v1/products/{id}",
12	protect(adminOnly(http.HandlerFunc(productH.Update))))

1func (h *Handler) Create(w http.ResponseWriter, r *http.Request) {
2	var in CreateRequest
3
4	dec := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20))
5	dec.DisallowUnknownFields()
6	if err := dec.Decode(&in); err != nil {
7		httpx.Error(w, 400, "invalid json")
8		return
9	}
10
11	p, err := h.svc.Create(r.Context(), in)
12	if err != nil {
13		httpx.FromError(w, err)
14		return
15	}
16	httpx.JSON(w, 201, p)
17}

1func (s *Service) Create(ctx context.Context, req CreateRequest) (*Product, error) {
2	if strings.TrimSpace(req.Name) == "" {
3		return nil, fmt.Errorf("%w: name is required", ErrValidation)
4	}
5	if req.PriceCents < 0 {
6		return nil, fmt.Errorf("%w: price cannot be negative", ErrValidation)
7	}
8	if req.PriceCents > 100_000_000 {
9		return nil, fmt.Errorf("%w: price is unrealistically high", ErrValidation)
10	}
11	if req.Stock < 0 {
12		return nil, fmt.Errorf("%w: stock cannot be negative", ErrValidation)
13	}
14
15	p := &Product{
16		Name:       strings.TrimSpace(req.Name),
17		PriceCents: req.PriceCents,      // the API speaks cents, never 12.99
18		Stock:      req.Stock,
19		Active:     true,
20	}
21	return p, s.repo.Create(ctx, p)
22}

1# get two tokens
2ADMIN=$(curl -s -X POST localhost:8080/v1/auth/login \
3  -d '{"email":"admin@shop.test","password":"password123"}' | jq -r .access_token)
4
5CUST=$(curl -s -X POST localhost:8080/v1/auth/login \
6  -d '{"email":"customer@shop.test","password":"password123"}' | jq -r .access_token)
7
8# no token at all → 401
9curl -si -X POST localhost:8080/v1/products \
10  -d '{"name":"Mug","price_cents":999,"stock":10}' | head -1
11
12# customer token → 403
13curl -si -X POST localhost:8080/v1/products -H "Authorization: Bearer $CUST" \
14  -d '{"name":"Mug","price_cents":999,"stock":10}' | head -1
15
16# admin token → 201
17curl -si -X POST localhost:8080/v1/products -H "Authorization: Bearer $ADMIN" \
18  -d '{"name":"Mug","price_cents":999,"stock":10}' | head -1
19
20# browsing needs no token at all → 200
21curl -si localhost:8080/v1/products | head -1