ld ac98b5ddbd feat(middleware): add AdminRequired authorization middleware ...

AdminRequired gates admin endpoints by checking user IsAdmin flag.

Placed AFTER AuthRequired; fetches user from repository, returns 403 for non-admins.

Soft-deleted users are rejected with 401 since FindByID excludes them.

Tests: admin passes, non-admin forbidden, soft-deleted admin rejected, missing user ID.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

2026-07-04 17:20:30 +08:00

..

auth_test.go

feat(middleware): add AdminRequired authorization middleware

2026-07-04 17:20:30 +08:00

auth.go

feat(middleware): add AdminRequired authorization middleware

2026-07-04 17:20:30 +08:00

requestid.go

Add structured logging with request ID middleware

2026-07-04 16:24:37 +08:00