clawbot 07fc63d9fa Wrap /user/{username} in RequireAuth middleware (closes #60) (#71) ...

Enforces authentication for the `/user/{username}` route group at the middleware layer, matching every other authenticated route group.

## Changes

- **`internal/server/routes.go`** (`setupUserRoutes`): added `r.Use(s.mw.RequireAuth())` immediately after the existing `r.Use(s.mw.CSRF())` on the `/user/{username}` group, so auth is enforced by design (CSRF first, then RequireAuth) — consistent with `/sources` and `/source/{sourceID}`.
- **`internal/handlers/profile.go`** (`HandleProfile`): removed the now-dead unauthenticated-redirect branch (RequireAuth guarantees an authenticated session before the handler runs). The handler still reads the username and user id from the session for the own-profile-only check; a request for another user's profile still returns 403. The session-retrieval error is now handled as a 500.

## Tests (`internal/handlers/profile_test.go`)

- own profile returns 200
- another user's profile returns 403
- an unauthenticated request to `/user/{username}` is redirected to `/pages/login` at the middleware layer and never reaches the endpoint handler (routing-level test replicating the CSRF + RequireAuth chain)

## Validation

`docker build .` (fmt-check, lint, test, build) passes.

Closes #60

Co-authored-by: sneak <sneak@sneak.berlin>
Co-authored-by: Jeffrey Paul <sneak@noreply.example.org>
Reviewed-on: #71
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

2026-08-07 14:00:16 +02:00

..

http.go

Raise HTTP WriteTimeout above the request middleware timeout (closes #62) (#72)

2026-08-07 13:58:28 +02:00

routes.go

Wrap /user/{username} in RequireAuth middleware (closes #60) (#71)

2026-08-07 14:00:16 +02:00

server.go

refactor: use pinned golangci-lint Docker image for linting (#55)

2026-03-25 02:16:38 +01:00