Paul Payne
f5a030fd44
- Auto-generate random 32-char bearer token on first startup, stored in secrets.yaml as api.bearerToken - BearerAuthMiddleware checks Authorization: Bearer <token> on all /api/ endpoints except /health, /health/reconcile, /events (SSE), and non-API paths (frontend static files) - Development mode (WILD_CENTRAL_ENV=development) skips auth entirely - Web app ApiClient: add setToken/clearToken/hasToken methods, persist token in localStorage, automatically include Authorization header on all API requests - Token can be found in secrets.yaml for CLI/automation use
118 lines
3.0 KiB
Go
118 lines
3.0 KiB
Go
package v1
|
|
|
|
import (
|
|
"bufio"
|
|
"fmt"
|
|
"log/slog"
|
|
"net"
|
|
"net/http"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/gorilla/mux"
|
|
)
|
|
|
|
// statusResponseWriter wraps http.ResponseWriter to capture the status code.
|
|
// Implements http.Hijacker so WebSocket upgrades work through the proxy.
|
|
type statusResponseWriter struct {
|
|
http.ResponseWriter
|
|
status int
|
|
}
|
|
|
|
func (w *statusResponseWriter) WriteHeader(code int) {
|
|
w.status = code
|
|
w.ResponseWriter.WriteHeader(code)
|
|
}
|
|
|
|
func (w *statusResponseWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
|
|
if hj, ok := w.ResponseWriter.(http.Hijacker); ok {
|
|
return hj.Hijack()
|
|
}
|
|
return nil, nil, fmt.Errorf("upstream ResponseWriter does not implement http.Hijacker")
|
|
}
|
|
|
|
func (w *statusResponseWriter) Flush() {
|
|
if fl, ok := w.ResponseWriter.(http.Flusher); ok {
|
|
fl.Flush()
|
|
}
|
|
}
|
|
|
|
// BearerAuthMiddleware returns middleware that requires a valid Bearer token
|
|
// on all API endpoints except health checks and the SSE event stream.
|
|
func BearerAuthMiddleware(token string) mux.MiddlewareFunc {
|
|
return func(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
path := r.URL.Path
|
|
|
|
// Public endpoints — no auth required
|
|
if path == "/api/v1/health" || path == "/api/v1/health/reconcile" ||
|
|
strings.HasSuffix(path, "/events") {
|
|
next.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
|
|
// Non-API paths (frontend static files) — no auth required
|
|
if !strings.HasPrefix(path, "/api/") {
|
|
next.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
|
|
auth := r.Header.Get("Authorization")
|
|
if auth == "" {
|
|
http.Error(w, `{"error":"authentication required"}`, http.StatusUnauthorized)
|
|
return
|
|
}
|
|
|
|
const prefix = "Bearer "
|
|
if !strings.HasPrefix(auth, prefix) || auth[len(prefix):] != token {
|
|
http.Error(w, `{"error":"invalid token"}`, http.StatusUnauthorized)
|
|
return
|
|
}
|
|
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
}
|
|
|
|
// RequestLoggingMiddleware logs method, path, status, and duration for each request.
|
|
// Long-lived connections (SSE, WebSocket) are excluded.
|
|
func RequestLoggingMiddleware(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
path := r.URL.Path
|
|
|
|
// Skip SSE and WebSocket endpoints (long-lived connections)
|
|
if strings.HasSuffix(path, "/events") || strings.HasSuffix(path, "/ws") || strings.HasSuffix(path, "/stream") {
|
|
next.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
|
|
// Security response headers
|
|
w.Header().Set("X-Content-Type-Options", "nosniff")
|
|
w.Header().Set("X-Frame-Options", "DENY")
|
|
w.Header().Set("Cache-Control", "no-store")
|
|
|
|
start := time.Now()
|
|
sw := &statusResponseWriter{ResponseWriter: w, status: http.StatusOK}
|
|
next.ServeHTTP(sw, r)
|
|
|
|
attrs := []any{
|
|
"status", sw.status,
|
|
"method", r.Method,
|
|
"path", path,
|
|
"duration", time.Since(start),
|
|
}
|
|
|
|
// Add route params if present
|
|
vars := mux.Vars(r)
|
|
if domain := vars["domain"]; domain != "" {
|
|
attrs = append(attrs, "domain", domain)
|
|
}
|
|
|
|
if sw.status >= 400 {
|
|
slog.Error("request", attrs...)
|
|
} else {
|
|
slog.Info("request", attrs...)
|
|
}
|
|
})
|
|
}
|