feat: add backend jwt middleware

backend/internal/auth/middleware_test.go

@@ -0,0 +1,67 @@
+package auth
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+func TestRequireAuthRejectsMissingToken(t *testing.T) {
+	env := newTestJWTEnv(t)
+	validator, err := NewValidator(env.issuer, env.jwksURL, WithNow(func() time.Time {
+		return env.now
+	}), WithHTTPClient(env.client))
+	if err != nil {
+		t.Fatalf("NewValidator() error = %v", err)
+	}
+
+	middleware := NewMiddleware(validator)
+	handler := middleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "/me", nil)
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusUnauthorized)
+	}
+}
+
+func TestRequireAuthAcceptsValidToken(t *testing.T) {
+	env := newTestJWTEnv(t)
+	validator, err := NewValidator(env.issuer, env.jwksURL, WithNow(func() time.Time {
+		return env.now
+	}), WithHTTPClient(env.client))
+	if err != nil {
+		t.Fatalf("NewValidator() error = %v", err)
+	}
+
+	middleware := NewMiddleware(validator)
+	handler := middleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		principal, ok := PrincipalFromRequest(r)
+		if !ok {
+			t.Fatal("principal missing from request")
+		}
+		if principal.Subject != testSubject {
+			t.Fatalf("principal.Subject = %q, want %q", principal.Subject, testSubject)
+		}
+		if principal.Email != "user@example.test" {
+			t.Fatalf("principal.Email = %q", principal.Email)
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "/me", nil)
+	req.Header.Set("Authorization", "Bearer "+env.token(t, tokenOptions{}))
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusNoContent)
+	}
+}