Godopu
5f87631530
- Implement getApiBaseUrl() and getAdminApiBaseUrl() to dynamically distinguish between Server/SSR (process.env.API_BASE_URL) and Client/CSR (process.env.NEXT_PUBLIC_API_BASE_URL) - Fix missing data on main landing page in containerized environment - Sanitize and trim ADMIN_TOKEN parsing in Go backend to prevent whitespace/quote mismatch - Real-time token validation in AdminLayout with auto-redirection on token mismatch - All unit and E2E test gates passed clean with unanimous PASS reviews
36 lines
839 B
Go
36 lines
839 B
Go
package httpx
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
// RequireAdminToken returns a Gin middleware that validates Bearer <token> against the configured admin token.
|
|
func RequireAdminToken(adminToken string) gin.HandlerFunc {
|
|
expectedToken := strings.Trim(adminToken, " \"'\r\n\t")
|
|
return func(c *gin.Context) {
|
|
if expectedToken == "" {
|
|
Unauthorized(c, "Admin API is disabled: ADMIN_TOKEN is not configured")
|
|
c.Abort()
|
|
return
|
|
}
|
|
|
|
auth := c.GetHeader("Authorization")
|
|
if auth == "" {
|
|
Unauthorized(c, "Missing Authorization header")
|
|
c.Abort()
|
|
return
|
|
}
|
|
|
|
parts := strings.SplitN(auth, " ", 2)
|
|
if len(parts) != 2 || !strings.EqualFold(parts[0], "Bearer") || strings.TrimSpace(parts[1]) != expectedToken {
|
|
Unauthorized(c, "Invalid admin bearer token")
|
|
c.Abort()
|
|
return
|
|
}
|
|
|
|
c.Next()
|
|
}
|
|
}
|