first round of files

internal/api/middleware/rbac.go

@@ -0,0 +1,16 @@
+package middleware
+
+import (
+	"net/http"
+)
+
+func RequireAdmin(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		isAdmin, _ := r.Context().Value(ContextKeyIsAdmin).(bool)
+		if !isAdmin {
+			http.Error(w, "forbidden", http.StatusForbidden)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}