From 5f4cbf5294fb5632b386c8f34adee0528b4ef227 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 25 Nov 2025 10:22:19 +0000
Subject: [PATCH] fix(auth): enforce authentication on write operations and fix
 CLI token auth

Co-authored-by: jnsgruk <668505+jnsgruk@users.noreply.github.com>
---
 src/client/tokens.rs          | 12 ++++++++++--
 src/server/routes/roasters.rs |  4 ++++
 src/server/routes/roasts.rs   |  3 +++
 3 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/src/client/tokens.rs b/src/client/tokens.rs
index 446636b..3730f72 100644
--- a/src/client/tokens.rs
+++ b/src/client/tokens.rs
@@ -40,7 +40,11 @@ impl<'a> TokensClient<'a> {
     pub async fn list(&self) -> Result<Vec<Token>> {
         let url = self.client.endpoint("api/v1/tokens")?;
 
-        let response = self.client.http_client().get(url).send().await?;
+        let response = self
+            .client
+            .request(reqwest::Method::GET, url)
+            .send()
+            .await?;
 
         self.client.handle_response(response).await
     }
@@ -50,7 +54,11 @@ impl<'a> TokensClient<'a> {
             .client
             .endpoint(&format!("api/v1/tokens/{}/revoke", id))?;
 
-        let response = self.client.http_client().post(url).send().await?;
+        let response = self
+            .client
+            .request(reqwest::Method::POST, url)
+            .send()
+            .await?;
 
         self.client.handle_response(response).await
     }
diff --git a/src/server/routes/roasters.rs b/src/server/routes/roasters.rs
index 469f078..3636b26 100644
--- a/src/server/routes/roasters.rs
+++ b/src/server/routes/roasters.rs
@@ -9,6 +9,7 @@ use crate::presentation::templates::{
     RoasterDetailTemplate, RoasterListTemplate, RoastersTemplate,
 };
 use crate::presentation::views::{ListNavigator, Paginated, RoastView, RoasterView};
+use crate::server::auth::AuthenticatedUser;
 use crate::server::errors::{ApiError, AppError, map_app_error};
 use crate::server::routes::render_html;
 use crate::server::routes::support::{
@@ -102,6 +103,7 @@ pub(crate) async fn list_roasters(
 
 pub(crate) async fn create_roaster(
     State(state): State<AppState>,
+    _auth_user: AuthenticatedUser,
     headers: HeaderMap,
     Query(query): Query<ListQuery>,
     payload: FlexiblePayload<NewRoaster>,
@@ -138,6 +140,7 @@ pub(crate) async fn get_roaster(
 
 pub(crate) async fn update_roaster(
     State(state): State<AppState>,
+    _auth_user: AuthenticatedUser,
     Path(id): Path<String>,
     Json(payload): Json<UpdateRoaster>,
 ) -> Result<Json<Roaster>, ApiError> {
@@ -161,6 +164,7 @@ pub(crate) async fn update_roaster(
 
 pub(crate) async fn delete_roaster(
     State(state): State<AppState>,
+    _auth_user: AuthenticatedUser,
     headers: HeaderMap,
     Path(id): Path<String>,
     Query(query): Query<ListQuery>,
diff --git a/src/server/routes/roasts.rs b/src/server/routes/roasts.rs
index 663b985..85ad366 100644
--- a/src/server/routes/roasts.rs
+++ b/src/server/routes/roasts.rs
@@ -9,6 +9,7 @@ use crate::domain::roasters::RoasterSortKey;
 use crate::domain::roasts::{NewRoast, Roast, RoastSortKey, RoastWithRoaster};
 use crate::presentation::templates::{RoastDetailTemplate, RoastListTemplate, RoastsTemplate};
 use crate::presentation::views::{ListNavigator, Paginated, RoastView, RoasterOptionView};
+use crate::server::auth::AuthenticatedUser;
 use crate::server::errors::{ApiError, AppError, map_app_error};
 use crate::server::routes::render_html;
 use crate::server::routes::support::{
@@ -96,6 +97,7 @@ pub(crate) async fn roast_page(
 
 pub(crate) async fn create_roast(
     State(state): State<AppState>,
+    _auth_user: AuthenticatedUser,
     headers: HeaderMap,
     Query(query): Query<ListQuery>,
     payload: FlexiblePayload<NewRoastSubmission>,
@@ -154,6 +156,7 @@ pub(crate) async fn get_roast(
 
 pub(crate) async fn delete_roast(
     State(state): State<AppState>,
+    _auth_user: AuthenticatedUser,
     headers: HeaderMap,
     Path(id): Path<String>,
     Query(query): Query<ListQuery>,