fix: List хендлер читает ?status=, проверяет права для не-published статусов

backend/cmd/api/main.go

@@ -86,7 +86,7 @@ func main() {
 	// Хендлеры
 	authHandler := handlers.NewAuthHandler(authSvc, cfg.AppEnv)
 	userHandler := handlers.NewUserHandler(userRepo)
-	placeHandler := handlers.NewPlaceHandler(placeSvc)
+	placeHandler := handlers.NewPlaceHandler(placeSvc, authSvc)
 	serviceHandler := handlers.NewServiceHandler(serviceRepo, tagRepo)
 	reviewHandler := handlers.NewReviewHandler(reviewRepo)
 	bookingHandler := handlers.NewBookingHandler(bookingRepo)

backend/internal/handlers/places.go

@@ -17,18 +17,38 @@ import (
 
 type PlaceHandler struct {
 	placeSvc *services.PlaceService
+	authSvc  *services.AuthService
 }
 
-func NewPlaceHandler(placeSvc *services.PlaceService) *PlaceHandler {
-	return &PlaceHandler{placeSvc: placeSvc}
+func NewPlaceHandler(placeSvc *services.PlaceService, authSvc *services.AuthService) *PlaceHandler {
+	return &PlaceHandler{placeSvc: placeSvc, authSvc: authSvc}
 }
 
 func (h *PlaceHandler) List(w http.ResponseWriter, r *http.Request) {
 	q := r.URL.Query()
 
+	status := q.Get("status")
+	if status == "" {
+		status = "published"
+	}
+	if status != "published" {
+		role := middleware.GetUserRole(r.Context())
+		if role == "" {
+			if parts := strings.SplitN(r.Header.Get("Authorization"), " ", 2); len(parts) == 2 && parts[0] == "Bearer" {
+				if claims, err := h.authSvc.ValidateAccessToken(parts[1]); err == nil {
+					role = claims.Role
+				}
+			}
+		}
+		if role != "moderator" && role != "superadmin" {
+			writeError(w, http.StatusForbidden, "access denied", nil)
+			return
+		}
+	}
+
 	filter := models.PlaceFilter{
 		Type:   q.Get("type"),
-		Status: "published",
+		Status: status,
 	}
 
 	if tags := q["tags"]; len(tags) > 0 {