rede5/saveinmed
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #79 from rede5/codex/update-context-middleware-for-pharmacy-tenant

Browse source 
Inject company_id into request context from auth middleware
This commit is contained in:
Tiago Yamamoto 2026-02-07 11:44:01 -03:00 committed by GitHub
commit 11bff5af03
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 14 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
backend-old/internal/http/middleware/auth.go
View file

@ -37,6 +37,7 @@ func RequireAuth(secret []byte, allowedRoles ...string) func(http.Handler) http.
}
ctx := context.WithValue(r.Context(), claimsKey, *claims)
ctx = context.WithValue(ctx, "company_id", claims.CompanyID)
next.ServeHTTP(w, r.WithContext(ctx))
})
}
@ -49,6 +50,7 @@ func OptionalAuth(secret []byte) func(http.Handler) http.Handler {
claims, err := parseToken(r, secret)
if err == nil && claims != nil {
ctx := context.WithValue(r.Context(), claimsKey, *claims)
ctx = context.WithValue(ctx, "company_id", claims.CompanyID)
next.ServeHTTP(w, r.WithContext(ctx))
} else {
next.ServeHTTP(w, r)

13
backend-old/internal/http/middleware/middleware_test.go
View file

@ -118,8 +118,10 @@ func TestRequireAuthValidToken(t *testing.T) {
tokenStr := createTestToken(secret, userID, "Admin", &companyID)
var receivedClaims Claims
var receivedCompanyID *uuid.UUID
handler := RequireAuth([]byte(secret))(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
receivedClaims, _ = GetClaims(r.Context())
receivedCompanyID, _ = r.Context().Value("company_id").(*uuid.UUID)
w.WriteHeader(http.StatusOK)
}))
@ -138,6 +140,9 @@ func TestRequireAuthValidToken(t *testing.T) {
if receivedClaims.Role != "Admin" {
t.Errorf("expected role 'Admin', got '%s'", receivedClaims.Role)
}
if receivedCompanyID == nil || *receivedCompanyID != companyID {
t.Errorf("expected companyID %s, got %v", companyID, receivedCompanyID)
}
}
func TestRequireAuthMissingToken(t *testing.T) {
@ -437,11 +442,14 @@ func TestOptionalAuthMissingToken(t *testing.T) {
func TestOptionalAuthValidToken(t *testing.T) {
secret := "secret"
userID, _ := uuid.NewV7()
tokenStr := createTestToken(secret, userID, "Admin", nil)
companyID, _ := uuid.NewV7()
tokenStr := createTestToken(secret, userID, "Admin", &companyID)
var gotClaims Claims
var receivedCompanyID *uuid.UUID
handler := OptionalAuth([]byte(secret))(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
gotClaims, _ = GetClaims(r.Context())
receivedCompanyID, _ = r.Context().Value("company_id").(*uuid.UUID)
w.WriteHeader(http.StatusOK)
}))
@ -456,6 +464,9 @@ func TestOptionalAuthValidToken(t *testing.T) {
if gotClaims.UserID != userID {
t.Errorf("expected userID %s, got %s", userID, gotClaims.UserID)
}
if receivedCompanyID == nil || *receivedCompanyID != companyID {
t.Errorf("expected companyID %s, got %v", companyID, receivedCompanyID)
}
}
// --- Security Headers Tests ---