Initial implementation of inventree

A small IT asset inventory system built around a nested folder tree,
matching the project brief: Go + html/template + Bootstrap 5 + vanilla JS,
SQLite storage (WAL, FKs, migrations), embedded templates/static assets,
single compiled binary.

- AJAX-driven inventory tree: lazy-loaded folder expansion with per-user
  persisted expand state, drag-and-drop move for folders/assets, safe
  delete-with-relocate-or-cascade confirmation, search with breadcrumbs.
- Assets: CRUD, duplicate, move, auto-generated IT-000001-style IDs,
  CSV import (with optional folder auto-create) and export.
- Admin-defined item types with custom fields (text/long_text/number/date/
  boolean/dropdown/url/ip_address).
- Configurable statuses, session-based auth (bcrypt, secure cookies),
  admin/user roles, user management.
- CLI: serve, version, database migrate, database backup; /healthz;
  graceful shutdown; Dockerfile/docker-compose/systemd unit; Go test suite.

internal/web/middleware.go

@@ -0,0 +1,65 @@
+package web
+
+import (
+	"net/http"
+
+	"inventree/internal/auth"
+	"inventree/internal/models"
+)
+
+// loadSession attaches the current user (if any) to the request context
+// based on the session cookie. It never blocks the request.
+func (a *App) loadSession(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		cookie, err := r.Cookie(auth.CookieName)
+		if err != nil || cookie.Value == "" {
+			next.ServeHTTP(w, r)
+			return
+		}
+		u, err := a.Auth.UserForToken(r.Context(), cookie.Value)
+		if err != nil {
+			next.ServeHTTP(w, r)
+			return
+		}
+		r = r.WithContext(auth.WithUser(r.Context(), u))
+		next.ServeHTTP(w, r)
+	})
+}
+
+// requireLogin redirects unauthenticated page requests to /login, and
+// returns 401 for AJAX/API requests instead.
+func (a *App) requireLogin(next http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if _, ok := auth.UserFromContext(r.Context()); !ok {
+			if isAjax(r) {
+				writeErr(w, http.StatusUnauthorized, "not authenticated")
+				return
+			}
+			http.Redirect(w, r, "/login?next="+r.URL.Path, http.StatusSeeOther)
+			return
+		}
+		next(w, r)
+	}
+}
+
+// requireAdmin additionally requires the current user to hold the admin
+// role.
+func (a *App) requireAdmin(next http.HandlerFunc) http.HandlerFunc {
+	return a.requireLogin(func(w http.ResponseWriter, r *http.Request) {
+		u, _ := auth.UserFromContext(r.Context())
+		if !u.IsAdmin() {
+			writeErr(w, http.StatusForbidden, "admin access required")
+			return
+		}
+		next(w, r)
+	})
+}
+
+func isAjax(r *http.Request) bool {
+	return r.Header.Get("X-Requested-With") == "XMLHttpRequest" || r.Header.Get("HX-Request") != ""
+}
+
+func currentUser(r *http.Request) *models.User {
+	u, _ := auth.UserFromContext(r.Context())
+	return u
+}