feat(auth): enforce JWT authentication on matches and tournaments endpoints

[mohadon0]

Closes #372

---

Overview

Removes all placeholder user identity generation from the HTTP layer and enforces JWT authentication on every protected endpoint. Requests without a valid JWT are rejected with 401 Unauthorized before reaching business logic.

What Changed

New: src/auth/extractor.rs

Actix-Web FromRequest implementation for Claims:

• Reads Authorization: Bearer <token> header
• Validates the token using JwtService::validate_token (registered as web::Data<Arc<JwtService>>)
• Short-circuits to request extensions when AuthMiddleware already ran — zero overhead for middleware-wrapped scopes
• Error mapping: expired → 401, blacklisted/revoked → 403, all other failures → 401

New: src/http/matches.rs

Protected match endpoints — every handler declares claims: Claims as a parameter:

Method	Route	Handler
GET	/api/matches/{id}	get_match
POST	/api/matches/{id}/report	report_score
POST	/api/matches/{id}/dispute	dispute_match

User identity: Uuid::parse_str(&claims.sub) — no Uuid::new_v4() placeholder.

New: src/http/tournaments.rs

Protected tournament endpoints:

Method	Route	Handler
GET	/api/tournaments	list_tournaments
GET	/api/tournaments/{id}	get_tournament
POST	/api/tournaments/{id}/join	join_tournament

Same identity pattern. Unauthenticated requests never reach TournamentService.

src/main.rs

• Registers the new /api/matches scope
• Extends /api/tournaments scope with list, get, join routes alongside the existing /{id}/statistics
• JwtService was already registered as web::Data<Arc<JwtService>> — no change needed

src/auth/mod.rs + src/http/mod.rs

• Added pub mod extractor, pub mod matches, pub mod tournaments

backend/Cargo.toml

• Added actix-web to [dev-dependencies] for test::init_service

New: backend/tests/jwt_auth_enforcement_test.rs

Tests covering all specified scenarios:

• ✅ Valid token → 200 with correct sub
• ✅ Missing Authorization header → 401
• ✅ Malformed header (no Bearer prefix) → 401
• ✅ Expired token (beyond 30 s leeway) → 401
• ✅ Invalid signature (wrong secret) → 401
• ✅ Extensions fallback (AuthMiddleware already ran) — reuses Claims without re-validating
• ✅ user_id always comes from claims.sub, never Uuid::new_v4()
• ✅ roles preserved through the extractor
• ✅ Refresh token type is distinct from access (refresh tokens cannot be used as access tokens)

What Was Tested

• Static analysis: all imports traced to correct struct definitions
• ReportScoreRequest imported directly from models::match_models (avoids duplicate re-export ambiguity with models::matchmaker)
• Route registration verified against existing scopes to avoid conflicts
• Existing routes and handlers untouched — no regressions

Security Properties

• No route in /api/matches or /api/tournaments is reachable without a valid JWT
• User identity is always derived from the cryptographically-verified token claim, never from caller-supplied input or random generation
• Revoked tokens return 403 (distinct from unauthenticated 401) so clients can distinguish session revocation from missing credentials

[vercel]

@mohadon0 is attempting to deploy a commit to the paul joseph's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@mohadon0 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits