gott/Middleware/AuthMiddleware.cs

using System.Threading.Tasks;
using Gott.Services;
using Microsoft.AspNetCore.Http;

namespace Gott.Middleware;

public class AuthMiddleware
{
    private readonly RequestDelegate _next;

    public AuthMiddleware(RequestDelegate next)
    {
        _next = next;
    }

    public async Task InvokeAsync(HttpContext ctx, AuthService auth, DatabaseService db)
    {
        var path = ctx.Request.Path.Value ?? "";

        // Static files, login and telegram webhook don't require auth
        var isTelegramWebhook = path.StartsWith("/api/telegram/webhook/") && ctx.Request.Method == "POST";
        var isSharedGet = path.StartsWith("/api/shared/") && ctx.Request.Method == "GET";
        if (!path.StartsWith("/api/") || path == "/api/auth/login" || isTelegramWebhook || isSharedGet)
        {
            await _next(ctx);
            return;
        }

        var token = ctx.Request.Cookies["gott_token"];
        var userId = auth.ValidateToken(token);

        if (userId == null)
        {
            ctx.Response.StatusCode = 401;
            await ctx.Response.WriteAsJsonAsync(new { error = "Not authenticated" });
            return;
        }

        ctx.Items["UserId"] = userId;

        var user = await db.GetUser(userId);
        ctx.Items["IsAdmin"] = user?.IsAdmin ?? false;

        await _next(ctx);
    }
}