marky

commit d1c9e11a7457eb2d7822cfb223a0080461f71714
parent de8cfea0fbc4d28e7b700ed98ac511d86bedc6b5
Author: David Eisinger <[email protected]>
Date:   Mon,  6 Oct 2025 23:31:10 -0400

Authorize /bookmarks

Diffstat:
M
README.md
 | 
4
++--
M
internal/api.go
 | 
4
++++

2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/README.md b/README.md
@@ -98,9 +98,9 @@ curl -i -X POST http://localhost:8080/bookmarks \
 
 ### GET /bookmarks
 
-List bookmarks in reverse chronological order, or search with full-text. When `q` is provided, results include an `excerpt` with highlighted matches. The endpoint can return JSON (default) or RSS.
+List the authenticated user’s bookmarks in reverse chronological order, or search with full‑text. When `q` is provided, results include an `excerpt` with highlighted matches. The endpoint can return JSON (default) or RSS.
 
-- Auth: required to see private bookmarks (session cookie or API token). If unauthenticated, only public bookmarks are returned.
+- Auth: required (session cookie or API token). Returns `401 Unauthorized` when unauthenticated.
 - Query params:
   - `limit` (optional, default 50, max 200)
   - `offset` (optional, default 0)
diff --git a/internal/api.go b/internal/api.go
@@ -321,6 +321,10 @@ func NewHandler(db *DB) (http.Handler, error) {
 
 		case http.MethodGet:
 			uid, _ := userIDFromRequest(r, db)
+			if uid == 0 {
+				http.Error(w, "unauthorized", http.StatusUnauthorized)
+				return
+			}
 			q := r.URL.Query()
 			limit := 50
 			offset := 0