app/delivery/middleware/auth.go

@@ -16,9 +16,8 @@ import (
 )
 
 // AuthMiddleware creates authentication middleware
-func AuthMiddleware() fiber.Handler {
+func Authenticate() fiber.Handler {
 	authService := authService.NewAuthService()
-
 	return func(c fiber.Ctx) error {
 		// Get token from Authorization header
 		authHeader := c.Get("Authorization")
@@ -26,17 +25,13 @@ func AuthMiddleware() fiber.Handler {
 			// Try to get from cookie
 			authHeader = c.Cookies("access_token")
 			if authHeader == "" {
-				return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
+				return c.Next()
-					"error": "authorization token required",
-				})
 			}
 		} else {
 			// Extract token from "Bearer <token>"
 			parts := strings.Split(authHeader, " ")
 			if len(parts) != 2 || parts[0] != "Bearer" {
-				return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
+				return c.Next()
-					"error": "invalid authorization header format",
-				})
 			}
 			authHeader = parts[1]
 		}
@@ -44,24 +39,18 @@ func AuthMiddleware() fiber.Handler {
 		// Validate token
 		claims, err := authService.ValidateToken(authHeader)
 		if err != nil {
-			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
+			return c.Next()
-				"error": "invalid or expired token",
-			})
 		}
 
 		// Get user from database
 		user, err := authService.GetUserByID(claims.UserID)
 		if err != nil {
-			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
+			return c.Next()
-				"error": "user not found",
-			})
 		}
 
 		// Check if user is active
 		if !user.IsActive {
-			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{
+			return c.Next()
-				"error": "user account is inactive",
-			})
 		}
 
 		// Create locale. LangID is overwritten by auth Token
@@ -80,9 +69,7 @@ func AuthMiddleware() fiber.Handler {
 
 		// We now populate the target user
 		if model.CustomerRole(user.Role.Name) != model.RoleAdmin {
-			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{
+			return c.Next()
-				"error": "admin access required",
-			})
 		}
 
 		targetUserID, err := strconv.Atoi(targetUserIDAttribute)
@@ -115,6 +102,18 @@ func AuthMiddleware() fiber.Handler {
 	}
 }
 
+func Authorize() fiber.Handler {
+	return func(c fiber.Ctx) error {
+		_, ok := localeExtractor.GetUserID(c)
+		if !ok {
+			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
+				"error": "not authenticated",
+			})
+		}
+		return c.Next()
+	}
+}
+
 // RequireAdmin creates admin-only middleware
 func RequireAdmin() fiber.Handler {
 	return func(c fiber.Ctx) error {

app/delivery/web/api/public/auth.go

@@ -49,7 +49,7 @@ func AuthHandlerRoutes(r fiber.Router) fiber.Router {
 	r.Get("/google", handler.GoogleLogin)
 	r.Get("/google/callback", handler.GoogleCallback)
 
-	authProtected := r.Group("", middleware.AuthMiddleware())
+	authProtected := r.Group("", middleware.Authorize())
 	authProtected.Get("/me", handler.Me)
 	authProtected.Post("/update-choice", handler.UpdateJWTToken)
 

app/delivery/web/api/public/routing.go

@@ -2,6 +2,7 @@ package public
 
 import (
 	"git.ma-al.com/goc_daniel/b2b/app/service/menuService"
+	constdata "git.ma-al.com/goc_daniel/b2b/app/utils/const_data"
 	"git.ma-al.com/goc_daniel/b2b/app/utils/i18n"
 	"git.ma-al.com/goc_daniel/b2b/app/utils/localeExtractor"
 	"git.ma-al.com/goc_daniel/b2b/app/utils/nullable"
@@ -31,12 +32,21 @@ func RoutingHandlerRoutes(r fiber.Router) fiber.Router {
 }
 
 func (h *RoutingHandler) GetRouting(c fiber.Ctx) error {
-	lang_id, ok := localeExtractor.GetLangID(c)
+	langId, ok := localeExtractor.GetLangID(c)
 	if !ok {
-		return c.Status(responseErrors.GetErrorStatus(responseErrors.ErrBadAttribute)).
+		return c.Status(responseErrors.GetErrorStatus(responseErrors.ErrInvalidBody)).
-			JSON(response.Make(nullable.GetNil(""), 0, responseErrors.GetErrorCode(c, responseErrors.ErrBadAttribute)))
+			JSON(response.Make(nullable.GetNil(""), 0, responseErrors.GetErrorCode(c, responseErrors.ErrInvalidBody)))
 	}
-	menu, err := h.menuService.GetRoutes(lang_id)
+
+	var roleId uint
+	customer, ok := localeExtractor.GetCustomer(c)
+	if !ok {
+		roleId = constdata.UNLOGGED_USER_ROLE_ID
+	} else {
+		roleId = customer.RoleID
+	}
+
+	menu, err := h.menuService.GetRoutes(langId, roleId)
 	if err != nil {
 		return c.Status(responseErrors.GetErrorStatus(err)).
 			JSON(response.Make(nullable.GetNil(""), 0, responseErrors.GetErrorCode(c, err)))

app/delivery/web/init.go

@@ -86,9 +86,10 @@ func (s *Server) Setup() error {
 
 	// API routes
 	s.api = s.app.Group("/api/v1")
+	s.api.Use(middleware.Authenticate())
 	s.public = s.api.Group("/public")
 	s.restricted = s.api.Group("/restricted")
-	s.restricted.Use(middleware.AuthMiddleware())
+	s.restricted.Use(middleware.Authorize())
 	s.webdav = s.api.Group("/webdav")
 	s.webdav.Use(middleware.Webdav())
 

app/model/routing.go

@@ -7,7 +7,6 @@ type Route struct {
 	Component string  `gorm:"type:varchar(255);not null;comment:path to component file" json:"component"`
 	Meta      *string `gorm:"type:longtext;default:'{}'" json:"meta,omitempty"`
 	Active    *bool   `gorm:"type:tinyint;default:1" json:"active,omitempty"`
-	SortOrder *int    `gorm:"type:int;default:0" json:"sort_order,omitempty"`
 }
 
 func (Route) TableName() string {

app/repos/routesRepo/routesRepo.go

@@ -7,7 +7,7 @@ import (
 )
 
 type UIRoutesRepo interface {
-	GetRoutes(langId uint) ([]model.Route, error)
+	GetRoutes(langId uint, roleId uint) ([]model.Route, error)
 	GetTopMenu(id uint, roleId uint) ([]model.B2BTopMenu, error)
 }
 
@@ -17,13 +17,18 @@ func New() UIRoutesRepo {
 	return &RoutesRepo{}
 }
 
-func (p *RoutesRepo) GetRoutes(langId uint) ([]model.Route, error) {
+func (p *RoutesRepo) GetRoutes(langId uint, roleId uint) ([]model.Route, error) {
 	routes := []model.Route{}
-	err := db.DB.Find(&routes, model.Route{Active: nullable.GetNil(true)}).Error
+
-	if err != nil {
+	err := db.
-		return nil, err
+		Get().
-	}
+		Model(model.Route{}).
-	return routes, nil
+		Joins("JOIN b2b_route_roles rr ON rr.route_id = b2b_routes.id").
+		Where(model.Route{Active: nullable.GetNil(true)}).
+		Where("rr.role_id = ?", roleId).
+		Find(&routes).Error
+
+	return routes, err
 }
 
 func (p *RoutesRepo) GetTopMenu(langId uint, roleId uint) ([]model.B2BTopMenu, error) {

app/service/menuService/menuService.go

@@ -88,8 +88,8 @@ func (s *MenuService) createTree(index int, all_categories *([]model.ScannedCate
 	return node, true
 }
 
-func (s *MenuService) GetRoutes(id_lang uint) ([]model.Route, error) {
+func (s *MenuService) GetRoutes(id_lang, roleId uint) ([]model.Route, error) {
-	return s.routesRepo.GetRoutes(id_lang)
+	return s.routesRepo.GetRoutes(id_lang, roleId)
 }
 
 func (s *MenuService) scannedToNormalCategory(scanned model.ScannedCategory) model.Category {

app/utils/const_data/consts.go

@@ -46,3 +46,5 @@ var TRANSLITERATION_TABLE = map[rune]string{
 	'ż': "z",
 	'ź': "z",
 }
+
+const UNLOGGED_USER_ROLE_ID = 4

bruno/api_v1/routes/Routes.yml

@@ -0,0 +1,15 @@
+info:
+  name: Routes
+  type: http
+  seq: 1
+
+http:
+  method: GET
+  url: ""
+  auth: inherit
+
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5

bruno/api_v1/routes/folder.yml

@@ -0,0 +1,7 @@
+info:
+  name: routes
+  type: folder
+  seq: 10
+
+request:
+  auth: inherit

i18n/migrations/20260302163100_routes.sql

@@ -42,6 +42,11 @@ INSERT IGNORE INTO `b2b_top_menu` (`menu_id`, `label`, `parent_id`, `params`, `a
 (3, JSON_COMPACT('{"name":"admin-products","trans":{"pl":{"label":"admin-products"},"en":{"label":"admin-products"},"de":{"label":"admin-products"}}}'),1,JSON_COMPACT('{}'),1,1),
 (9, JSON_COMPACT('{"name":"carts","trans":{"pl":{"label":"Koszyki"},"en":{"label":"Carts"},"de":{"label":"Warenkörbe"}}}'),3,JSON_COMPACT('{"route": {"name": "home", "params":{"locale": ""}}}'),1,1);
 
+CREATE TABLE `b2b_route_roles` ( 
+  `route_id` INT NOT NULL,
+  `role_id` BIGINT UNSIGNED NOT NULL,
+   PRIMARY KEY (`id`, `role_id`)
+);
 
 
 -- +goose Down

i18n/migrations/20260302163122_create_tables.sql

@@ -310,6 +310,24 @@ ON b2b_specific_price_customer (b2b_id_customer);
 CREATE INDEX idx_bsp_country_rel
 ON b2b_specific_price_country (b2b_id_country);
 
+CREATE TABLE b2b_route_roles ( 
+  route_id INT NOT NULL,
+  role_id BIGINT UNSIGNED NOT NULL,
+  PRIMARY KEY (route_id, role_id),
+  INDEX idx_role_id (role_id),
+  INDEX idx_route_id (route_id),
+  CONSTRAINT FK_b2b_route_roles_route_id
+    FOREIGN KEY (route_id)
+    REFERENCES b2b_routes (id)
+    ON DELETE CASCADE
+    ON UPDATE CASCADE,
+  CONSTRAINT FK_b2b_route_roles_role_id
+    FOREIGN KEY (role_id)
+    REFERENCES b2b_roles (id)
+    ON DELETE CASCADE
+    ON UPDATE CASCADE
+) ENGINE=InnoDB;
+
 DELIMITER //
 
 CREATE FUNCTION IF NOT EXISTS slugify_eu(input TEXT)
@@ -415,3 +433,4 @@ DROP TABLE IF EXISTS b2b_specific_price;
 DROP TABLE IF EXISTS b2b_specific_price_product;
 DROP TABLE IF EXISTS b2b_specific_price_category;
 DROP TABLE IF EXISTS b2b_specific_price_product_attribute;
+DROP TABLE IF EXISTS b2b_route_roles;

i18n/migrations/20260302163123_create_tables_data.sql

@@ -46,4 +46,34 @@ INSERT INTO `b2b_role_permissions` (`role_id`, `permission_id`) VALUES ('3', '2'
 INSERT INTO `b2b_role_permissions` (`role_id`, `permission_id`) VALUES ('3', '3');
 INSERT INTO `b2b_role_permissions` (`role_id`, `permission_id`) VALUES ('3', '4');
 INSERT INTO `b2b_role_permissions` (`role_id`, `permission_id`) VALUES ('3', '5');
+
+INSERT INTO `b2b_route_roles` (`route_id`, `role_id`) VALUES
+(1, '1'),
+(1, '2'),
+(1, '3'),
+(2, '1'),
+(2, '2'),
+(2, '3'),
+(3, '1'),
+(3, '2'),
+(3, '3'),
+(3, '4'),
+(4, '1'),
+(4, '2'),
+(4, '3'),
+(4, '4'),
+(5, '1'),
+(5, '2'),
+(5, '3'),
+(5, '4'),
+(6, '1'),
+(6, '2'),
+(6, '3'),
+(6, '4'),
+(7, '1'),
+(7, '2'),
+(7, '3'),
+(7, '4');
+
+
 -- +goose Down