Add auth protection sample and standardize json.

backend/internal/handlers/logto.go

@@ -15,11 +15,11 @@ import (
 // In production, use Redis/MongoDB
 
 type SessionStorage struct {
-	session sessions.Session
+	Session sessions.Session
 }
 
 func (s *SessionStorage) GetItem(key string) string {
-	value := s.session.Get(key)
+	value := s.Session.Get(key)
 	if value == nil {
 		return ""
 	}
@@ -31,12 +31,12 @@ func (s *SessionStorage) GetItem(key string) string {
 }
 
 func (s *SessionStorage) SetItem(key, value string) {
-	s.session.Set(key, value)
-	s.session.Save()
+	s.Session.Set(key, value)
+	s.Session.Save()
 }
 
-// getLogtoConfig returns Logto config from environment variables
-func getLogtoConfig() *client.LogtoConfig {
+// GetLogtoConfig returns Logto config from environment variables
+func GetLogtoConfig() *client.LogtoConfig {
 	return &client.LogtoConfig{
 		Endpoint:  os.Getenv("LOGTO_ENDPOINT"),
 		AppId:     os.Getenv("LOGTO_APP_ID"),
@@ -48,7 +48,7 @@ func getLogtoConfig() *client.LogtoConfig {
 // Note: The /service/auth endpoint is for debugging purposes only
 func HomeHandler(ctx *gin.Context) {
 	session := sessions.Default(ctx)
-	logtoClient := client.NewLogtoClient(getLogtoConfig(), &SessionStorage{session: session})
+	logtoClient := client.NewLogtoClient(GetLogtoConfig(), &SessionStorage{Session: session})
 	
 	var debugInfo string
 	debugInfo = "<h1>Logto Auth Debugging Page</h1>"
@@ -141,11 +141,11 @@ func HomeHandler(ctx *gin.Context) {
 // SignInHandler starts the Logto sign-in flow
 func SignInHandler(ctx *gin.Context) {
 	session := sessions.Default(ctx)
-	logtoClient := client.NewLogtoClient(getLogtoConfig(), &SessionStorage{session: session})
+	logtoClient := client.NewLogtoClient(GetLogtoConfig(), &SessionStorage{Session: session})
 	redirectUri := os.Getenv("LOGTO_REDIRECT_URI")
 	signInUri, err := logtoClient.SignIn(redirectUri)
 	if err != nil {
-		ctx.String(http.StatusInternalServerError, err.Error())
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
 	ctx.Redirect(http.StatusTemporaryRedirect, signInUri)
@@ -154,10 +154,10 @@ func SignInHandler(ctx *gin.Context) {
 // CallbackHandler handles the Logto sign-in callback
 func CallbackHandler(ctx *gin.Context) {
 	session := sessions.Default(ctx)
-	logtoClient := client.NewLogtoClient(getLogtoConfig(), &SessionStorage{session: session})
+	logtoClient := client.NewLogtoClient(GetLogtoConfig(), &SessionStorage{Session: session})
 	err := logtoClient.HandleSignInCallback(ctx.Request)
 	if err != nil {
-		ctx.String(http.StatusInternalServerError, err.Error())
+		ctx.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
 	// Redirect to the frontend page instead of the backend auth page
@@ -167,11 +167,11 @@ func CallbackHandler(ctx *gin.Context) {
 // SignOutHandler starts the Logto sign-out flow
 func SignOutHandler(ctx *gin.Context) {
 	session := sessions.Default(ctx)
-	logtoClient := client.NewLogtoClient(getLogtoConfig(), &SessionStorage{session: session})
+	logtoClient := client.NewLogtoClient(GetLogtoConfig(), &SessionStorage{Session: session})
 	postSignOutRedirectUri := os.Getenv("LOGTO_POST_SIGN_OUT_REDIRECT_URI")
 	signOutUri, err := logtoClient.SignOut(postSignOutRedirectUri)
 	if err != nil {
-		ctx.String(http.StatusOK, err.Error())
+		ctx.JSON(http.StatusOK, gin.H{"error": err.Error()})
 		return
 	}
 	ctx.Redirect(http.StatusTemporaryRedirect, signOutUri)
@@ -180,10 +180,10 @@ func SignOutHandler(ctx *gin.Context) {
 // UserIdTokenClaimsHandler returns the user's ID token claims as JSON
 func UserIdTokenClaimsHandler(ctx *gin.Context) {
 	session := sessions.Default(ctx)
-	logtoClient := client.NewLogtoClient(getLogtoConfig(), &SessionStorage{session: session})
+	logtoClient := client.NewLogtoClient(GetLogtoConfig(), &SessionStorage{Session: session})
 	idTokenClaims, err := logtoClient.GetIdTokenClaims()
 	if err != nil {
-		ctx.String(http.StatusOK, err.Error())
+		ctx.JSON(http.StatusOK, gin.H{"error": err.Error()})
 		return
 	}
 	ctx.JSON(http.StatusOK, idTokenClaims)

backend/internal/middleware/auth.go

@@ -0,0 +1,24 @@
+package middleware
+
+import (
+	"net/http"
+
+	"starter/backend/internal/handlers"
+
+	"github.com/gin-contrib/sessions"
+	"github.com/gin-gonic/gin"
+	"github.com/logto-io/go/client"
+)
+
+// AuthRequired 是 Logto 认证中间件，未认证用户返回 401
+func AuthRequired() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		session := sessions.Default(c)
+		logtoClient := client.NewLogtoClient(handlers.GetLogtoConfig(), &handlers.SessionStorage{Session: session})
+		if !logtoClient.IsAuthenticated() {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
+			return
+		}
+		c.Next()
+	}
+} 

backend/internal/routes/router.go

@@ -16,7 +16,7 @@ func RegisterRoutes(rg *gin.RouterGroup) {
 	rg.Use(middleware.Logger())
 	
 	// Define routes
-	rg.GET("/health", handlers.HealthCheck)
+	rg.GET("/health", middleware.AuthRequired(), handlers.HealthCheck)
 
 	// Logto authentication routes
 	rg.GET("/auth/", handlers.HomeHandler)