feat(07-01): add bcrypt, locale override, and validation rules

Co-authored-by: Cursor <cursoragent@cursor.com>

surf/locale_from_principal.go

@@ -0,0 +1,19 @@
+package surf
+
+import (
+	"net/http"
+
+	"git.golem15.com/golem15/summercms/bouncer"
+	"git.golem15.com/golem15/summercms/towel"
+)
+
+// LocaleFromPrincipal overrides the header locale with the authenticated
+// principal's PreferredLocale when that value is non-empty.
+func LocaleFromPrincipal(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if p, ok := bouncer.User(r.Context()); ok && p.PreferredLocale != "" {
+			r = r.WithContext(towel.WithLocale(r.Context(), p.PreferredLocale))
+		}
+		next.ServeHTTP(w, r)
+	})
+}

surf/router.go

@@ -453,6 +453,9 @@ func BuildRouter(app *backpack.App, plugins []party.Plugin) (*Router, error) {
 	}); err != nil {
 		return nil, err
 	}
+	if err := r.RegisterMiddleware("surf", "locale.from-principal", LocaleFromPrincipal); err != nil {
+		return nil, err
+	}
 	if app != nil {
 		corsCfg, err := LoadCORSConfig(app.Config)
 		if err != nil {