feat(auth): implement user and device authentication

backend-api/internal/transport/httpapi/router.go

@@ -22,13 +22,15 @@ type EventLogger func(string)
 type RouteRegistrar func(gin.IRoutes) error
 
 type RouterDependencies struct {
-	Database            DatabasePinger
-	RegisterAdminRoutes RouteRegistrar
-	LogEvent            EventLogger
+	Database             DatabasePinger
+	RegisterPublicRoutes RouteRegistrar
+	RegisterAdminRoutes  RouteRegistrar
+	AdminSessions        AdminAuthenticator
+	LogEvent             EventLogger
 }
 
 type AdminWeb interface {
-	Register(gin.IRoutes)
+	RegisterProtected(gin.IRoutes)
 }
 
 func NewAdminRouteRegistrar(
@@ -45,7 +47,7 @@ func NewAdminRouteRegistrar(
 		if err := registerAdminAPI(routes, services); err != nil {
 			return err
 		}
-		web.Register(routes)
+		web.RegisterProtected(routes)
 		return nil
 	}, nil
 }
@@ -57,6 +59,12 @@ func NewRouter(dependencies RouterDependencies) (http.Handler, error) {
 	if dependencies.RegisterAdminRoutes == nil {
 		return nil, errors.New("admin route registrar is required")
 	}
+	if dependencies.RegisterPublicRoutes == nil {
+		return nil, errors.New("public route registrar is required")
+	}
+	if dependencies.AdminSessions == nil {
+		return nil, errors.New("admin authenticator is required")
+	}
 	if dependencies.LogEvent == nil {
 		return nil, errors.New("event logger is required")
 	}
@@ -70,8 +78,11 @@ func NewRouter(dependencies RouterDependencies) (http.Handler, error) {
 	}
 
 	router.GET("/healthz", healthHandler(dependencies.Database))
+	if err := dependencies.RegisterPublicRoutes(router); err != nil {
+		return nil, err
+	}
 	adminRoutes := router.Group("")
-	adminRoutes.Use(loopbackAdminOnly())
+	adminRoutes.Use(requireAdminSession(dependencies.AdminSessions))
 	if err := dependencies.RegisterAdminRoutes(adminRoutes); err != nil {
 		return nil, err
 	}