Added auth check on all routes

cmd/main.go

@@ -20,9 +20,9 @@ func initGin() {
 
 	r.GET("/ping", internal.Ping)
 
-	r.GET("/get-all-articles", internal.GetAllArticles)
+	r.GET("/get-all-articles", internal.AuthCheck, internal.GetAllArticles)
-	r.POST("/add-article", internal.AddArticle)
+	r.POST("/add-article", internal.AuthCheck, internal.AddArticle)
-	r.DELETE("/delete-article", internal.DeleteArticle)
+	r.DELETE("/delete-article", internal.AuthCheck, internal.DeleteArticle)
 
 	r.POST("/login", internal.LoginUser)
 	r.POST("/logout", internal.LogoutUser)

internal/auth.go

@@ -78,3 +78,23 @@ func LogoutUser(c *gin.Context) {
 	removeSession(user)
 	SendOkMessageToClient(c, "User successfully logged out.")
 }
+
+func AuthCheck(c *gin.Context) {
+	var user User
+	username, password, isOk := c.Request.BasicAuth()
+	if !isOk {
+		SendErrorMessageToClient(c, "Incorrect or missing user credentials.")
+		c.Abort()
+		return
+	}
+
+	user.Email = username
+	user.Password = password
+	user.Password = getUserHashedPassword(user)
+
+	if !isUserLoggedIn(user) {
+		SendErrorMessageToClient(c, "Authentification failed, credentials could be wrong, user may not be logged in, session may have expired.")
+		c.Abort()
+		return
+	}
+}

web/admin-gui/src/views/Home.vue

@@ -16,6 +16,7 @@ onMounted(async function() {
 function addArticle() {
     fetch("http://localhost:8080/add-article", {
         method: "POST",
+        headers: {"Authorization" : `Basic ${btoa(`${username.value}:${password.value}`)}`},
         body: JSON.stringify({
             id_name: `${Math.random() * 100}`,
             content: {},
@@ -27,7 +28,7 @@ function addArticle() {
 }
 
 function logArticles() {
-    fetch("http://localhost:8080/get-all-articles")
+    fetch("http://localhost:8080/get-all-articles", {headers: {"Authorization" : `Basic ${btoa(`${username.value}:${password.value}`)}`}})
         .then(response => response.json())
         .then(result => console.log(result))
 }
@@ -35,6 +36,7 @@ function logArticles() {
 function deleteArticle(articleID: String) {
     fetch("http://localhost:8080/delete-article", {
         method: "DELETE",
+        headers: {"Authorization" : `Basic ${btoa(`${username.value}:${password.value}`)}`},
         body: JSON.stringify({
             id_name: articleID
         })