add step list for server creation

local/middleware/auth.go

@@ -16,7 +16,6 @@ import (
 	"github.com/google/uuid"
 )
 
-// CachedUserInfo holds cached user authentication and permission data
 type CachedUserInfo struct {
 	UserID      string
 	Username    string
@@ -25,7 +24,6 @@ type CachedUserInfo struct {
 	CachedAt    time.Time
 }
 
-// AuthMiddleware provides authentication and permission middleware.
 type AuthMiddleware struct {
 	membershipService *service.MembershipService
 	cache             *cache.InMemoryCache
@@ -34,7 +32,6 @@ type AuthMiddleware struct {
 	openJWTHandler    *jwt.OpenJWTHandler
 }
 
-// NewAuthMiddleware creates a new AuthMiddleware.
 func NewAuthMiddleware(ms *service.MembershipService, cache *cache.InMemoryCache, jwtHandler *jwt.JWTHandler, openJWTHandler *jwt.OpenJWTHandler) *AuthMiddleware {
 	auth := &AuthMiddleware{
 		membershipService: ms,
@@ -44,24 +41,20 @@ func NewAuthMiddleware(ms *service.MembershipService, cache *cache.InMemoryCache
 		openJWTHandler:    openJWTHandler,
 	}
 
-	// Set up bidirectional relationship for cache invalidation
 	ms.SetCacheInvalidator(auth)
 
 	return auth
 }
 
-// Authenticate is a middleware for JWT authentication with enhanced security.
 func (m *AuthMiddleware) AuthenticateOpen(ctx *fiber.Ctx) error {
 	return m.AuthenticateWithHandler(m.openJWTHandler.JWTHandler, true, ctx)
 }
 
-// Authenticate is a middleware for JWT authentication with enhanced security.
 func (m *AuthMiddleware) Authenticate(ctx *fiber.Ctx) error {
 	return m.AuthenticateWithHandler(m.jwtHandler, false, ctx)
 }
 
 func (m *AuthMiddleware) AuthenticateWithHandler(jwtHandler *jwt.JWTHandler, isOpenToken bool, ctx *fiber.Ctx) error {
-	// Log authentication attempt
 	ip := ctx.IP()
 	userAgent := ctx.Get("User-Agent")
 
@@ -89,7 +82,6 @@ func (m *AuthMiddleware) AuthenticateWithHandler(jwtHandler *jwt.JWTHandler, isO
 		})
 	}
 
-	// Validate token length to prevent potential attacks
 	token := parts[1]
 	if len(token) < 10 || len(token) > 2048 {
 		logging.Error("Authentication failed: invalid token length from IP %s", ip)
@@ -113,7 +105,6 @@ func (m *AuthMiddleware) AuthenticateWithHandler(jwtHandler *jwt.JWTHandler, isO
 		})
 	}
 
-	// Additional security: validate user ID format
 	if claims.UserID == "" || len(claims.UserID) < 10 {
 		logging.Error("Authentication failed: invalid user ID in token from IP %s", ip)
 		return ctx.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
@@ -127,7 +118,6 @@ func (m *AuthMiddleware) AuthenticateWithHandler(jwtHandler *jwt.JWTHandler, isO
 		ctx.Locals("userInfo", userInfo)
 		ctx.Locals("authTime", time.Now())
 	} else {
-		// Preload and cache user info to avoid database queries on permission checks
 		userInfo, err := m.getCachedUserInfo(ctx.UserContext(), claims.UserID)
 		if err != nil {
 			logging.Error("Authentication failed: unable to load user info for %s from IP %s: %v", claims.UserID, ip, err)
@@ -145,7 +135,6 @@ func (m *AuthMiddleware) AuthenticateWithHandler(jwtHandler *jwt.JWTHandler, isO
 	return ctx.Next()
 }
 
-// HasPermission is a middleware for checking user permissions with enhanced logging.
 func (m *AuthMiddleware) HasPermission(requiredPermission string) fiber.Handler {
 	return func(ctx *fiber.Ctx) error {
 		userID, ok := ctx.Locals("userID").(string)
@@ -160,7 +149,6 @@ func (m *AuthMiddleware) HasPermission(requiredPermission string) fiber.Handler
 			return ctx.Next()
 		}
 
-		// Validate permission parameter
 		if requiredPermission == "" {
 			logging.Error("Permission check failed: empty permission requirement")
 			return ctx.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
@@ -168,7 +156,6 @@ func (m *AuthMiddleware) HasPermission(requiredPermission string) fiber.Handler
 			})
 		}
 
-		// Use cached user info from authentication step - no database queries needed
 		userInfo, ok := ctx.Locals("userInfo").(*CachedUserInfo)
 		if !ok {
 			logging.Error("Permission check failed: no cached user info in context from IP %s", ctx.IP())
@@ -177,7 +164,6 @@ func (m *AuthMiddleware) HasPermission(requiredPermission string) fiber.Handler
 			})
 		}
 
-		// Check if user has permission using cached data
 		has := m.hasPermissionFromCache(userInfo, requiredPermission)
 
 		if !has {
@@ -192,16 +178,13 @@ func (m *AuthMiddleware) HasPermission(requiredPermission string) fiber.Handler
 	}
 }
 
-// AuthRateLimit applies rate limiting specifically for authentication endpoints
 func (m *AuthMiddleware) AuthRateLimit() fiber.Handler {
 	return m.securityMW.AuthRateLimit()
 }
 
-// RequireHTTPS redirects HTTP requests to HTTPS in production
 func (m *AuthMiddleware) RequireHTTPS() fiber.Handler {
 	return func(ctx *fiber.Ctx) error {
 		if ctx.Protocol() != "https" && ctx.Get("X-Forwarded-Proto") != "https" {
-			// Allow HTTP in development/testing
 			if ctx.Hostname() != "localhost" && ctx.Hostname() != "127.0.0.1" {
 				httpsURL := "https://" + ctx.Hostname() + ctx.OriginalURL()
 				return ctx.Redirect(httpsURL, fiber.StatusMovedPermanently)
@@ -211,11 +194,9 @@ func (m *AuthMiddleware) RequireHTTPS() fiber.Handler {
 	}
 }
 
-// getCachedUserInfo retrieves and caches complete user information including permissions
 func (m *AuthMiddleware) getCachedUserInfo(ctx context.Context, userID string) (*CachedUserInfo, error) {
 	cacheKey := fmt.Sprintf("userinfo:%s", userID)
 
-	// Try cache first
 	if cached, found := m.cache.Get(cacheKey); found {
 		if userInfo, ok := cached.(*CachedUserInfo); ok {
 			logging.DebugWithContext("AUTH_CACHE", "User info for %s found in cache", userID)
@@ -223,13 +204,11 @@ func (m *AuthMiddleware) getCachedUserInfo(ctx context.Context, userID string) (
 		}
 	}
 
-	// Cache miss - load from database
 	user, err := m.membershipService.GetUserWithPermissions(ctx, userID)
 	if err != nil {
 		return nil, err
 	}
 
-	// Build permission map for fast lookups
 	permissions := make(map[string]bool)
 	for _, p := range user.Role.Permissions {
 		permissions[p.Name] = true
@@ -243,34 +222,26 @@ func (m *AuthMiddleware) getCachedUserInfo(ctx context.Context, userID string) (
 		CachedAt:    time.Now(),
 	}
 
-	// Cache for 15 minutes
 	m.cache.Set(cacheKey, userInfo, 15*time.Minute)
 	logging.DebugWithContext("AUTH_CACHE", "User info for %s cached with %d permissions", userID, len(permissions))
 
 	return userInfo, nil
 }
 
-// hasPermissionFromCache checks permissions using cached user info (no database queries)
 func (m *AuthMiddleware) hasPermissionFromCache(userInfo *CachedUserInfo, permission string) bool {
-	// Super Admin and Admin have all permissions
 	if userInfo.RoleName == "Super Admin" || userInfo.RoleName == "Admin" {
 		return true
 	}
 
-	// Check specific permission in cached map
 	return userInfo.Permissions[permission]
 }
 
-// InvalidateUserPermissions removes cached user info for a user
 func (m *AuthMiddleware) InvalidateUserPermissions(userID string) {
 	cacheKey := fmt.Sprintf("userinfo:%s", userID)
 	m.cache.Delete(cacheKey)
 	logging.InfoWithContext("AUTH_CACHE", "User info cache invalidated for user %s", userID)
 }
 
-// InvalidateAllUserPermissions clears all cached user info (useful for role/permission changes)
 func (m *AuthMiddleware) InvalidateAllUserPermissions() {
-	// This would need to be implemented based on your cache interface
-	// For now, just log that invalidation was requested
 	logging.InfoWithContext("AUTH_CACHE", "All user info caches invalidation requested")
 }