bvandeusen 4492826354 feat(auth): add RequireAdmin middleware for /api/admin/* routes ...

Replaces the old X-API-Token-based RequireAdmin in middleware.go with a
context-aware RequireAdmin() that runs after RequireUser, checks
user.IsAdmin, and returns 403 {"error":"not_authorized"} for non-admins
or 500 {"error":"internal_error"} if RequireUser was bypassed. Updates
server.go to mount RequireUser then RequireAdmin on the /api/admin group.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-29 17:27:47 -04:00

..

server_test.go

feat(api): rewrite /api/radio with weighted shuffle v1

2026-04-27 08:08:10 -04:00

server.go

feat(auth): add RequireAdmin middleware for /api/admin/* routes

2026-04-29 17:27:47 -04:00