feat: added API gateway

internal/gw/middleware/auth.go

@@ -0,0 +1,69 @@
+package middleware
+
+import (
+	"context"
+	"net/http"
+	"strings"
+
+	"datarush/internal/gw/domain"
+	"datarush/internal/gw/grpc_client"
+)
+
+type contextKey string
+
+const (
+	UserIDKey contextKey = "user_id"
+)
+
+type AuthMiddleware struct {
+	authClient *grpc_client.AuthClient
+}
+
+func NewAuthMiddleware(authClient *grpc_client.AuthClient) *AuthMiddleware {
+	return &AuthMiddleware{
+		authClient: authClient,
+	}
+}
+
+func (m *AuthMiddleware) Authenticate(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		authHeader := r.Header.Get("Authorization")
+		if authHeader == "" {
+			respondWithError(w, domain.NewUnauthorizedError("missing authorization header"))
+			return
+		}
+
+		parts := strings.Split(authHeader, " ")
+		if len(parts) != 2 || parts[0] != "Bearer" {
+			respondWithError(w, domain.NewUnauthorizedError("invalid authorization header format"))
+			return
+		}
+
+		token := parts[1]
+
+		userID, err := m.authClient.ValidateToken(r.Context(), token)
+		if err != nil {
+			respondWithError(w, domain.NewUnauthorizedError("invalid token"))
+			return
+		}
+
+		ctx := context.WithValue(r.Context(), UserIDKey, userID)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+func GetUserIDFromContext(ctx context.Context) (string, error) {
+	userID, ok := ctx.Value(UserIDKey).(string)
+	if !ok || userID == "" {
+		return "", domain.ErrUnauthorized
+	}
+	return userID, nil
+}
+
+func respondWithError(w http.ResponseWriter, err *domain.AppError) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(err.StatusCode)
+
+	response := domain.NewErrorResponse(err.Err, err.Message)
+	w.Write([]byte(`{"error":"` + response.Error + `","message":"` + response.Message + `"}`))
+}