fix(auth): enforce authentication on write operations and fix CLI token auth

Co-authored-by: jnsgruk <668505+jnsgruk@users.noreply.github.com>

src/client/tokens.rs

@@ -40,7 +40,11 @@ impl<'a> TokensClient<'a> {
     pub async fn list(&self) -> Result<Vec<Token>> {
         let url = self.client.endpoint("api/v1/tokens")?;
 
-        let response = self.client.http_client().get(url).send().await?;
+        let response = self
+            .client
+            .request(reqwest::Method::GET, url)
+            .send()
+            .await?;
 
         self.client.handle_response(response).await
     }
@@ -50,7 +54,11 @@ impl<'a> TokensClient<'a> {
             .client
             .endpoint(&format!("api/v1/tokens/{}/revoke", id))?;
 
-        let response = self.client.http_client().post(url).send().await?;
+        let response = self
+            .client
+            .request(reqwest::Method::POST, url)
+            .send()
+            .await?;
 
         self.client.handle_response(response).await
     }

src/server/routes/roasters.rs

@@ -9,6 +9,7 @@ use crate::presentation::templates::{
     RoasterDetailTemplate, RoasterListTemplate, RoastersTemplate,
 };
 use crate::presentation::views::{ListNavigator, Paginated, RoastView, RoasterView};
+use crate::server::auth::AuthenticatedUser;
 use crate::server::errors::{ApiError, AppError, map_app_error};
 use crate::server::routes::render_html;
 use crate::server::routes::support::{
@@ -102,6 +103,7 @@ pub(crate) async fn list_roasters(
 
 pub(crate) async fn create_roaster(
     State(state): State<AppState>,
+    _auth_user: AuthenticatedUser,
     headers: HeaderMap,
     Query(query): Query<ListQuery>,
     payload: FlexiblePayload<NewRoaster>,
@@ -138,6 +140,7 @@ pub(crate) async fn get_roaster(
 
 pub(crate) async fn update_roaster(
     State(state): State<AppState>,
+    _auth_user: AuthenticatedUser,
     Path(id): Path<String>,
     Json(payload): Json<UpdateRoaster>,
 ) -> Result<Json<Roaster>, ApiError> {
@@ -161,6 +164,7 @@ pub(crate) async fn update_roaster(
 
 pub(crate) async fn delete_roaster(
     State(state): State<AppState>,
+    _auth_user: AuthenticatedUser,
     headers: HeaderMap,
     Path(id): Path<String>,
     Query(query): Query<ListQuery>,

src/server/routes/roasts.rs

@@ -9,6 +9,7 @@ use crate::domain::roasters::RoasterSortKey;
 use crate::domain::roasts::{NewRoast, Roast, RoastSortKey, RoastWithRoaster};
 use crate::presentation::templates::{RoastDetailTemplate, RoastListTemplate, RoastsTemplate};
 use crate::presentation::views::{ListNavigator, Paginated, RoastView, RoasterOptionView};
+use crate::server::auth::AuthenticatedUser;
 use crate::server::errors::{ApiError, AppError, map_app_error};
 use crate::server::routes::render_html;
 use crate::server::routes::support::{
@@ -96,6 +97,7 @@ pub(crate) async fn roast_page(
 
 pub(crate) async fn create_roast(
     State(state): State<AppState>,
+    _auth_user: AuthenticatedUser,
     headers: HeaderMap,
     Query(query): Query<ListQuery>,
     payload: FlexiblePayload<NewRoastSubmission>,
@@ -154,6 +156,7 @@ pub(crate) async fn get_roast(
 
 pub(crate) async fn delete_roast(
     State(state): State<AppState>,
+    _auth_user: AuthenticatedUser,
     headers: HeaderMap,
     Path(id): Path<String>,
     Query(query): Query<ListQuery>,