start reports/moderation in backend

backend/routes/auth/discord.go

@@ -107,7 +107,7 @@ func (s *Server) discordCallback(w http.ResponseWriter, r *http.Request) error {
 
 		// TODO: implement user + token permissions
 		tokenID := xid.New()
-		token, err := s.Auth.CreateToken(u.ID, tokenID, false, false, true)
+		token, err := s.Auth.CreateToken(u.ID, tokenID, u.IsAdmin, false, true)
 		if err != nil {
 			return err
 		}

backend/routes/auth/fedi_mastodon.go

@@ -128,7 +128,7 @@ func (s *Server) mastodonCallback(w http.ResponseWriter, r *http.Request) error
 
 		// TODO: implement user + token permissions
 		tokenID := xid.New()
-		token, err := s.Auth.CreateToken(u.ID, tokenID, false, false, true)
+		token, err := s.Auth.CreateToken(u.ID, tokenID, u.IsAdmin, false, true)
 		if err != nil {
 			return err
 		}

backend/routes/mod/get_reports.go

@@ -0,0 +1,13 @@
+package mod
+
+import (
+	"fmt"
+	"net/http"
+)
+
+func (s *Server) getReports(w http.ResponseWriter, r *http.Request) error {
+	showClosed := r.FormValue("closed") == "true"
+
+	fmt.Println("closed =", showClosed)
+	return nil
+}

backend/routes/mod/routes.go

@@ -0,0 +1,52 @@
+package mod
+
+import (
+	"net/http"
+
+	"codeberg.org/u1f320/pronouns.cc/backend/server"
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/render"
+)
+
+type Server struct {
+	*server.Server
+}
+
+func Mount(srv *server.Server, r chi.Router) {
+	s := &Server{Server: srv}
+
+	r.With(MustAdmin).Route("/admin", func(r chi.Router) {
+		r.Get("/reports", server.WrapHandler(s.getReports))
+		r.Get("/reports/by-user/{id}", nil)
+		r.Get("/reports/by-reporter/{id}", nil)
+
+		r.Patch("/reports/{id}", nil)
+	})
+}
+
+func MustAdmin(next http.Handler) http.Handler {
+	fn := func(w http.ResponseWriter, r *http.Request) {
+		claims, ok := server.ClaimsFromContext(r.Context())
+		if !ok {
+			render.Status(r, http.StatusForbidden)
+			render.JSON(w, r, server.APIError{
+				Code:    server.ErrForbidden,
+				Message: "Forbidden",
+			})
+			return
+		}
+
+		if !claims.UserIsAdmin {
+			render.Status(r, http.StatusForbidden)
+			render.JSON(w, r, server.APIError{
+				Code:    server.ErrForbidden,
+				Message: "Forbidden",
+			})
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	}
+
+	return http.HandlerFunc(fn)
+}