feat(api): /devices register + paseto v4 (middleware Bearer, bootstrap mobile du token)

backend/handlers/middleware.go

@@ -0,0 +1,39 @@
+package handlers
+
+import (
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/vaultdrop/backend/pkg/api"
+	"github.com/vaultdrop/backend/pkg/auth"
+)
+
+const DeviceIDKey = "device_id"
+
+// Auth issues/verifies device bearer tokens; set once at startup (cmd/server).
+var Auth *auth.Manager
+
+// RequireDevice authenticates the bearer paseto token and stores the resolved
+// device_id in the gin context (cf. docs/api-v1.md §2).
+func RequireDevice(c *gin.Context) {
+
+	header := c.GetHeader("Authorization")
+	token, found := strings.CutPrefix(header, "Bearer ")
+
+	if Auth == nil || !found || token == "" {
+		api.Error(c, 401, "UNAUTHORIZED", "missing bearer token")
+		c.Abort()
+		return
+	}
+
+	deviceID, err := Auth.Verify(token)
+	if err != nil {
+		api.Error(c, 401, "UNAUTHORIZED", "invalid or expired token")
+		c.Abort()
+		return
+	}
+
+	c.Set(DeviceIDKey, deviceID)
+	c.Next()
+
+}