refactor: authorize API routes with per-endpoint scopes (#1823)

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
This commit is contained in:
Elias Schneider
2026-10-09 21:33:14 +02:00
committed by GitHub
co-authored by copilot-swe-agent[bot]
parent 1bd6f006c8
commit 0ec6bfa191
48 changed files with 1422 additions and 681 deletions
@@ -43,7 +43,7 @@ func TestImageUploadRoutesLimitRequestSize(t *testing.T) {
apiKeyModule, err := apikey.New(t.Context(), apikey.Dependencies{DB: db, CleanupDisabled: true})
require.NoError(t, err)
authMiddleware := middleware.NewAuthMiddleware(apiKeyModule, userService, jwtService)
auth := middleware.NewAuthorization(apiKeyModule, userService, jwtService)
fileSizeLimitMiddleware := middleware.NewFileSizeLimitMiddleware()
user := model.User{Username: "upload-admin", IsAdmin: true}
@@ -54,9 +54,9 @@ func TestImageUploadRoutesLimitRequestSize(t *testing.T) {
router := gin.New()
router.Use(middleware.NewErrorHandlerMiddleware().Add())
apiGroup := router.Group("/api")
NewUserController(apiGroup, authMiddleware, fileSizeLimitMiddleware, nil, userService, nil, func(c *gin.Context) { c.Next() })
NewAppImagesController(apiGroup, authMiddleware, fileSizeLimitMiddleware, nil)
apiRouter := auth.Router(router.Group("/api"))
NewUserController(apiRouter, fileSizeLimitMiddleware, nil, userService, nil, func(c *gin.Context) { c.Next() })
NewAppImagesController(apiRouter, fileSizeLimitMiddleware, nil)
routes := []string{
"/api/users/user-id/profile-picture",