feat(auth): Implement database-backed user authentication and

persistence

This commit introduces a major architectural change by replacing the
previous hardcoded user and data system with a robust, database-driven
approach. It lays the foundation for persistent data storage for all
application models.

Key Changes:

- **Database Integration:** - Added `GORM` and `SQLite` for the database
layer. - The database is now initialized and migrated on application
startup. - Configuration is managed through environment variables
(`DATABASE`, `USERS_FILE`).

- **User Authentication & Management:** - The login endpoint
(`/api/token`) now authenticates users against the database. - JWT
claims are now populated with real user data (`id`, `username`,
`is_superuser`). - Implemented a system to seed the database with
initial users from a `users.json` file.

- **New User API Endpoints:** - `GET /api/users`: Retrieves a list of
all users (superuser access required). - `GET /api/users/user`: Fetches
the data for the currently authenticated user based on their JWT.

- **Data Model Overhaul:** - Refactored all data models (`User`,
`Category`, `Operation`, `Subcategory`) to include GORM tags,
relationships, and a `BaseModel` with auto-generated UUIDs for primary
keys. - Separated user-related structs into `User` (database model),
`AuthRequest` (login payload), and `UserResponse` (safe API response).

- **Middleware & Routing:** - Improved JWT error handling for clearer
client-side messages. - Added a new middleware to allow passing the JWT
in the request body for more flexible client integration.

backend/server/configure.go

@@ -2,6 +2,8 @@ package server
 
 import (
 	"backend/api"
+	"backend/database"
+	"backend/internal/internaljwt"
 	"backend/utils"
 	"os"
 
@@ -13,6 +15,7 @@ import (
 
 func Configure(app *fiber.App) {
 	utils.LoadEnv("wallet.conf")
+	database.InitDatabase()
 	log.SetLevel(log.LevelDebug)
 	app.Use(cors.New(cors.Config{
 		AllowOrigins: "http://localhost:3000",
@@ -22,13 +25,39 @@ func Configure(app *fiber.App) {
 	apiGroup := app.Group("/api")
 
 	apiGroup.Post("/token", api.Login)
-	apiGroup.Get("/accessible", api.Accessible)
-	app.Use(jwtware.New(jwtware.Config{
+	app.Use(internaljwt.JwtFromBody, jwtware.New(jwtware.Config{
 		SigningKey: jwtware.SigningKey{
 			Key: []byte(os.Getenv("JWT_SECRET_KEY")),
 		},
+		ErrorHandler: func(c *fiber.Ctx, err error) error {
+			if err.Error() == "Missing or malformed JWT" {
+				return c.Status(
+					fiber.StatusBadRequest,
+				).JSON(
+					fiber.Map{
+						"status":  "error",
+						"message": "Missing or malformed JWT",
+						"data":    nil,
+					},
+				)
+			}
+			return c.Status(
+				fiber.StatusUnauthorized,
+			).JSON(
+				fiber.Map{
+					"status":  "error",
+					"message": "Invalid or expired JWT",
+					"data":    nil,
+					"error":   err.Error(),
+				},
+			)
+		},
 	}))
-	apiGroup.Get("/rescticted", api.Restricted)
+
+	usersGroup := apiGroup.Group("/users")
+	usersGroup.Get("/", api.GetAllUsers)
+	usersGroup.Get("/user", api.GetUserData)
+
 	operationGroup := apiGroup.Group("/operation")
 	operationGroup.Get("/", api.GetAllOperation)