Add admin authz middleware

main.go

@@ -91,6 +91,7 @@ func main() {
 	app.Use(middlewares.MfaEnrollMiddleware)
 	app.Use(middlewares.MfaVerifyMiddleware)
 	app.Use(middlewares.TemplatesMiddleware)
+	app.Use("/admin", middlewares.AuthzAdmin)
 
 	// Controllers
 	app.Get("/", controllers.Homepage)

middlewares/authorization.go

@@ -0,0 +1,34 @@
+package middlewares
+
+import (
+	"git.readonly.ch/bouzoure/popvaud-people/helpers"
+	"git.readonly.ch/bouzoure/popvaud-people/models"
+	"github.com/gofiber/fiber/v2"
+)
+
+func AuthzAdmin(c *fiber.Ctx) error {
+	sess, err := helpers.GetSessionStore(c)
+	if err != nil {
+		return err
+	}
+
+	db, err := helpers.GetDatabase()
+	if err != nil {
+		return err
+	}
+
+	var allowAccess bool
+	userid := sess.Get("userid")
+
+	if userid != nil {
+		var user models.User
+		db.First(&user, "id = ?", userid.(uint))
+		allowAccess = user.IsAdmin
+	}
+
+	if !allowAccess {
+		return fiber.NewError(fiber.StatusForbidden, "Forbidden (authz_admin)")
+	}
+
+	return c.Next()
+}