second commit

internal/middleware/webhook_auth.go

@@ -0,0 +1,26 @@
+package middleware
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/gochat/gochat/internal/auth"
+	"github.com/gochat/gochat/pkg/response"
+)
+
+// WebhookAuth validates webhook tokens for channel callback routes.
+// Reference: P2E §4 — webhook authentication per channel type
+func WebhookAuth(registry *auth.WebhookTokenRegistry) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		channelType := c.Param("channel_type")
+		identifier := c.Param("identifier")
+
+		valid, err := registry.Validate(channelType, identifier, c.Request)
+		if err != nil || !valid {
+			response.AbortWithStatusError(c, http.StatusUnauthorized, response.ErrUnauthorized, "Invalid webhook token")
+			return
+		}
+		c.Next()
+	}
+}