feat: auth and rate limit middleware

internal/handler/middleware.go

@@ -0,0 +1,81 @@
+package handler
+
+import (
+	"net/http"
+	"strings"
+
+	"aiaa-notification-service/internal/cache"
+	"aiaa-notification-service/internal/model"
+	"aiaa-notification-service/internal/store"
+
+	"github.com/gin-gonic/gin"
+)
+
+// AdminAuth checks the admin key for management API endpoints.
+func AdminAuth(adminKey string) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		key := extractBearer(c)
+		if key == "" || key != adminKey {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
+			return
+		}
+		c.Next()
+	}
+}
+
+// SourceAuth identifies the source by its API key and sets it in context.
+func SourceAuth(s *store.Store) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		key := extractBearer(c)
+		if key == "" {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "missing api key"})
+			return
+		}
+		source, err := s.GetSourceByAPIKey(c.Request.Context(), key)
+		if err != nil {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid api key"})
+			return
+		}
+		c.Set("source", source)
+		c.Next()
+	}
+}
+
+// RateLimit applies per-source rate limiting.
+func RateLimit(cache *cache.Cache, defaultLimit int) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		source, exists := c.Get("source")
+		if !exists {
+			c.Next()
+			return
+		}
+		src := source.(*model.Source)
+		allowed, retryAfter, err := cache.CheckRateLimit(c.Request.Context(), src.ID, defaultLimit)
+		if err != nil {
+			// Redis error — allow pass through
+			c.Next()
+			return
+		}
+		if !allowed {
+			c.AbortWithStatusJSON(http.StatusTooManyRequests, gin.H{
+				"error":       "rate_limit_exceeded",
+				"message":     "too many requests",
+				"retry_after": retryAfter,
+			})
+			return
+		}
+		c.Next()
+	}
+}
+
+func extractBearer(c *gin.Context) string {
+	auth := c.GetHeader("Authorization")
+	if auth == "" {
+		return ""
+	}
+	parts := strings.SplitN(auth, " ", 2)
+	if len(parts) != 2 || !strings.EqualFold(parts[0], "bearer") {
+		return ""
+	}
+	return parts[1]
+}