Extract myId from BasicAuth header instead of query param when available

api/auth_middleware.go

@@ -103,19 +103,22 @@ func (app *ApiServer) getAuthedWallet(c *fiber.Ctx) string {
 // - the user is not authorized to act on behalf of "myId"
 // - the user is not authorized to act on behalf of "myWallet"
 func (app *ApiServer) authMiddleware(c *fiber.Ctx) error {
-	wallet := app.recoverAuthorityFromSignatureHeaders(c)
-
-	if wallet == "" {
-		signer, _ := app.getApiSigner(c)
-		if signer != nil {
-			wallet = strings.ToLower(signer.Address)
-		}
+	var wallet string
+	var myId int32
+
+	signer, _ := app.getApiSigner(c)
+	if signer != nil {
+		wallet = strings.ToLower(signer.Address)
+		c.Locals("myId", signer.UserId)
+		myId = int32(signer.UserId)
+	} else {
+		wallet = app.recoverAuthorityFromSignatureHeaders(c)
+		myId = app.getMyId(c)
 	}
 
 	c.Locals("authedWallet", wallet)
 
 	// Not authorized to act on behalf of myId
-	myId := app.getMyId(c)
 	if myId != 0 && !app.isAuthorizedRequest(c.Context(), myId, wallet) {
 		return fiber.NewError(
 			fiber.StatusForbidden,

api/request_helpers.go

@@ -14,6 +14,7 @@ import (
 
 // Signer holds the address, public key, and private key for signing transactions
 type Signer struct {
+	UserId     int
 	Address    string
 	PrivateKey *ecdsa.PrivateKey
 }
@@ -56,6 +57,11 @@ func (app *ApiServer) getApiSigner(c *fiber.Ctx) (*Signer, error) {
 		return nil, fmt.Errorf("invalid Basic Auth format")
 	}
 
+	userId, err := strconv.Atoi(parts[0])
+	if err != nil {
+		return nil, fmt.Errorf("invalid userId: %w", err)
+	}
+
 	// The private key is in the password field (parts[1])
 	privateKeyHex := strings.TrimPrefix(parts[1], "0x")
 
@@ -69,6 +75,7 @@ func (app *ApiServer) getApiSigner(c *fiber.Ctx) (*Signer, error) {
 	address := crypto.PubkeyToAddress(privateKey.PublicKey)
 
 	return &Signer{
+		UserId:     userId,
 		Address:    address.Hex(),
 		PrivateKey: privateKey,
 	}, nil