[server] move jwt auth middleware to the root

[capcom6]

Summary by CodeRabbit

• Refactor
  • Reworked authentication middleware so login and registration are publicly accessible while authentication is enforced globally for other API endpoints.
  • Role-based authorization for admin actions remains in place on protected routes.
  • Adjusted middleware registration so per-route access controls behave consistently across read and write endpoints.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: adf84c36-ccac-4fe9-b6d4-f06d0e0f1cfd

📥 Commits

Reviewing files that changed from the base of the PR and between 63f9e32 and fe3c207.

📒 Files selected for processing (5)

• internal/server/admin/users/handler.go
• internal/server/auth/handler.go
• internal/server/middlewares/jwtauth/jwtauth.go
• internal/server/module.go
• internal/server/projects/handler.go

💤 Files with no reviewable changes (3)

• internal/server/auth/handler.go
• internal/server/projects/handler.go
• internal/server/admin/users/handler.go

🚧 Files skipped from review as they are similar to previous changes (2)

• internal/server/module.go
• internal/server/middlewares/jwtauth/jwtauth.go

---

📝 Walkthrough

Walkthrough

Centralized JWT authentication: jwtauth.New is now provided via DI and applied globally to the API v1 middleware chain (with login/register bypass); individual handlers remove per-route jwtauth.New registrations and rely on the global middleware plus per-route role guards.

Changes

Cohort / File(s)	Summary
Global JWT Middleware Setup internal/server/module.go, internal/server/middlewares/jwtauth/jwtauth.go	Added a DI provider that exports jwtauth.New as a named jwtauth handler and wired it into the API v1 middleware chain. jwt middleware now includes a Next predicate that skips JWT validation for normalized paths /api/v1/auth/login and /api/v1/auth/register.
Route Handler Middleware Cleanup internal/server/admin/users/handler.go, internal/server/auth/handler.go, internal/server/projects/handler.go	Removed inline registration of jwtauth.New(h.jwtSvc, h.usersSvc) from route group definitions; handlers still use error handling and per-route role checks (jwtauth.WithRole) where applicable.

Sequence Diagram(s)

sequenceDiagram
    autonumber
    actor Client as Client
    participant API as "API v1 Middleware"
    participant JWT as "jwtauth (keyauth middleware)"
    participant Users as "Users Service"
    participant Handler as "Route Handler"

    Client->>API: HTTP request (/api/v1/...)
    API->>JWT: invoke global jwtauth
    alt path is /auth/login or /auth/register
        JWT-->>API: Next() -> skip validation (rgba(0,128,0,0.5))
        API->>Handler: call route handler (no user in context)
    else other paths
        JWT->>JWT: validate token, parse claims (rgba(0,0,255,0.5))
        JWT->>Users: load user by claims.userID (rgba(255,165,0,0.5))
        Users-->>JWT: user or not found
        alt user missing or invalid
            JWT-->>API: respond 401/403
        else user valid
            JWT-->>API: set user in context
            API->>Handler: call route handler (user available)
        end
    end

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• [users] add module #2 — Changes the jwtauth middleware provider and wiring into the request pipeline; directly overlaps with the centralized middleware and provider changes in this PR.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title accurately describes the main architectural change: moving the JWT authentication middleware from individual route handlers to the root/global API level, improving middleware organization.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

🤖 Pull request artifacts

Platform	File
🐳 Docker	GitHub Container Registry
🍎 Darwin arm64	backend_Darwin_arm64.tar.gz
🍎 Darwin x86_64	backend_Darwin_x86_64.tar.gz
🐧 Linux arm64	backend_Linux_arm64.tar.gz
🐧 Linux i386	backend_Linux_i386.tar.gz
🐧 Linux x86_64	backend_Linux_x86_64.tar.gz
🪟 Windows arm64	backend_Windows_arm64.zip
🪟 Windows i386	backend_Windows_i386.zip
🪟 Windows x86_64	backend_Windows_x86_64.zip

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@internal/server/middlewares/jwtauth/jwtauth.go`:
- Around line 22-28: The Next function in jwtauth.go uses exact equality on
c.Path(), which fails for requests with trailing slashes; update the Next
callback to normalize the request path before comparing (e.g., trim trailing
slashes or canonicalize the path) and then check against the public endpoints
(login/register) so requests like "/api/v1/auth/login/" are recognized as
public; locate the Next func in jwtauth.go and replace the direct c.Path()
comparisons with a normalizedPath variable (using a trim or canonicalize
approach) and compare that to the known public paths.

In `@internal/server/module.go`:
- Around line 61-65: The middleware chain currently registers
jwtauth.ErrorsHandler() after jwtAuth so keyauth errors returned by jwtAuth
bypass the error translator; change the order in the v1.Use call so
jwtauth.ErrorsHandler() is placed before jwtAuth (keep validation.Middleware
as-is) so ErrorsHandler wraps jwtAuth and can convert
ErrInvalidToken/ErrExpiredToken into proper 401 responses.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c06a8d7f-9e7b-4db6-93cd-e2180e6bf285

📥 Commits

Reviewing files that changed from the base of the PR and between d704667 and 63f9e32.

📒 Files selected for processing (5)

• internal/server/admin/users/handler.go
• internal/server/auth/handler.go
• internal/server/middlewares/jwtauth/jwtauth.go
• internal/server/module.go
• internal/server/projects/handler.go

💤 Files with no reviewable changes (3)

• internal/server/auth/handler.go
• internal/server/admin/users/handler.go
• internal/server/projects/handler.go