feat: add backend jwt middleware

backend/cmd/api/main.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"net/http"
 	"os"
@@ -9,6 +10,8 @@ import (
 	"syscall"
 	"time"
 
+	"proxui/backend/internal/auth"
+
 	"forgejo.digital-droplets.de/philschlo/proxui/platform/config"
 	"forgejo.digital-droplets.de/philschlo/proxui/platform/logging"
 )
@@ -22,12 +25,27 @@ func main() {
 	}
 
 	logger := logging.New("backend", cfg.AppEnv, cfg.LogLevel)
+	jwtValidator, err := auth.NewValidator(
+		cfg.SupabaseIssuer,
+		cfg.SupabaseJWKSURL,
+		auth.WithHMACSecret(cfg.SupabaseJWTSecret),
+	)
+	if err != nil {
+		logger.Error("failed to initialize jwt validator", "error", err)
+		os.Exit(1)
+	}
+	authMiddleware := auth.NewMiddleware(jwtValidator)
 
 	mux := http.NewServeMux()
 	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
 		_, _ = w.Write([]byte(`{"status":"ok","service":"backend"}`))
 	})
+	mux.Handle("GET /me", authMiddleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		principal, _ := auth.PrincipalFromRequest(r)
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(principal)
+	})))
 
 	server := &http.Server{
 		Addr:              cfg.BackendAddr,