add frontend auth middleware, embed user data in frontend html

internal/database/token.go

@@ -19,7 +19,7 @@ type Token struct {
 	ID      ulid.ULID
 	AppID   ulid.ULID
 	UserID  ulid.ULID
-	Scopes  []string
+	Scopes  TokenScopes
 	Expires time.Time
 }
 
@@ -43,3 +43,34 @@ type TokenClaims struct {
 	UserID  ulid.ULID `json:"sub"`
 	jwt.RegisteredClaims
 }
+
+type TokenScope string
+
+const (
+	// All scopes below
+	TokenScopeAll          TokenScope = "all"
+	TokenScopeAccountsRead TokenScope = "accounts.read"
+	// Controls whether tokens have access to sensitive account data, NOT if they can use `/accounts/@me` endpoints.
+	TokenScopeAccountsMe    TokenScope = "accounts.me"
+	TokenScopeAccountsWrite TokenScope = "accounts.write"
+)
+
+func (s TokenScope) IsValid() bool {
+	switch s {
+	case TokenScopeAccountsRead, TokenScopeAccountsMe, TokenScopeAccountsWrite:
+		return true
+	default:
+		return false
+	}
+}
+
+type TokenScopes []TokenScope
+
+func (s TokenScopes) Has(scope TokenScope) bool {
+	for i := range s {
+		if s[i] == scope || s[i] == TokenScopeAll {
+			return true
+		}
+	}
+	return false
+}