Best way to check user permissions in a Go web app router - go

Question

My web app has URLs at three access levels:
Those accessible by anyone (login page and static assets)
Those accessible regular users and admins who are logged in
Those accessible only by admins who are logged in
I should specify the minimum access level for each URL pattern in my router, so that people below that level are blocked. (I suppose they should get HTTP error 401 or 403.)
How do I best implement these checks so that I don't have to remember to put them in every URL handler function separately (which is very easy to forget)? Ideally I'd like to do something like this:
router.Get("/someRegularPage", regularAccess(handleSomeRegularPage))
router.Get("/someAdminPage", adminAccess(handleSomeAdminPage))
router.Get("/", publicAccess(handleLoginPage))
Is there some semi-standard middleware to do this and how does that work? How hard would it be to write my own?
Additionally, it would be great if the default permission was to deny access to everybody in case I forget to specify the access level for some URL. A compiler warning or error would be ideal.

Answer 1

Writing your own is not hard. Assuming you store your admin token in an environment variable called ADMINTOKEN :
func AdminOnly(f func(w http.ResponseWriter, r *http.Request)) func(w http.ResponseWriter, r *http.Request) {
return func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Access-Control-Allow-Headers", "Accept, Content-Type, Content-Length, Accept-Encoding, Authorization")
if r.Method == "OPTIONS" {
f(w, r)
return
}
h := r.Header.Get("Authorization")
token := strings.TrimPrefix(h, "Bearer ")
if token == os.Getenv("ADMINTOKEN") {
f(w, r)
return
}
http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
}
}
OPTIONS method may have to be authorized regardless because of CORS.

Answer 2

The short answer is to write middleware to handle authorization. A longer answer that may help you out just as much in the long run would be to use appropriate routing paths for your endpoints alongside that middleware. For instance, you could prefix all of your admin routes with /api/admin and then wrap the router for individual routes after that with the relevant admin-auth middleware.