feat: implement circuit breaker, fix auth vulnerability

internal/middleware/auth.go

@@ -2,6 +2,7 @@ package middleware
 
 import (
 	"log"
+	"net/http"
 	"strings"
 
 	"gophergate/internal/db"
@@ -27,26 +28,16 @@ func AuthMiddleware(database *db.DB) gin.HandlerFunc {
 		// Try to resolve client from database
 		var clientID string
 		err := database.Get(&clientID, "UPDATE client_tokens SET last_used_at = CURRENT_TIMESTAMP WHERE token = ? AND is_active = 1 RETURNING client_id", token)
-		
+
 		if err == nil {
 			c.Set("auth", models.AuthInfo{
 				Token:    token,
 				ClientID: clientID,
 			})
+			c.Next()
 		} else {
-			// Fallback to token-prefix derivation (matches Rust behavior)
-			prefixLen := len(token)
-			if prefixLen > 8 {
-				prefixLen = 8
-			}
-			clientID = "client_" + token[:prefixLen]
-			c.Set("auth", models.AuthInfo{
-				Token:    token,
-				ClientID: clientID,
-			})
-			log.Printf("Token not found in DB, using fallback client ID: %s", clientID)
+			log.Printf("Token not found or inactive in DB: %s", token)
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid or inactive token"})
 		}
-
-		c.Next()
 	}
 }