feat: Adds ApiKey support

Author: NeedleInAJayStack

README.md

@@ -9,6 +9,7 @@ Create a `.env` file in this directory that contains necessary environment varia
 ```
 USERNAME=<username>
 PASSWORD=<password>
+API_KEY=<apikey>
 
 HOST=<host>
 PORT=<port>

authController.go

@@ -54,13 +54,17 @@ func (a authController) getAuthToken(w http.ResponseWriter, r *http.Request) {
 	w.Write(httpJson)
 }
 
-func authMiddleware(jwtSecret string, next http.Handler) http.Handler {
+func authMiddleware(jwtSecret string, apiKey string, next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		var bearerTokenString string
+		var apiKeyString string
 		for _, headerValue := range r.Header["Authorization"] {
 			if strings.HasPrefix(headerValue, "Bearer ") {
 				bearerTokenString, _ = strings.CutPrefix(headerValue, "Bearer ")
 			}
+			if strings.HasPrefix(headerValue, "ApiKey ") {
+				apiKeyString, _ = strings.CutPrefix(headerValue, "ApiKey ")
+			}
 		}
 
 		if bearerTokenString != "" {
@@ -86,6 +90,12 @@ func authMiddleware(jwtSecret string, next http.Handler) http.Handler {
 				w.WriteHeader(http.StatusUnauthorized)
 				return
 			}
+		} else if apiKey != "" && apiKeyString != "" {
+			if apiKeyString != apiKey {
+				log.Printf("Invalid API key")
+				w.WriteHeader(http.StatusUnauthorized)
+				return
+			}
 		} else {
 			log.Printf("Authorization scheme not supported")
 			w.WriteHeader(http.StatusUnauthorized)

main.go

@@ -74,6 +74,7 @@ func main() {
 
 	serverConfig := ServerConfig{
 		authenticator:        authenticator,
+		apiKey:               os.Getenv("API_KEY"),
 		jwtSecret:            os.Getenv("JWT_SECRET"),
 		tokenDurationSeconds: 60 * 60, // 1 hour
 

server.go

@@ -9,6 +9,7 @@ import (
 type ServerConfig struct {
 	// Auth
 	authenticator        authenticator
+	apiKey               string
 	jwtSecret            string
 	tokenDurationSeconds int
 
@@ -49,9 +50,9 @@ func NewServer(serverConfig ServerConfig) (http.Handler, error) {
 	handleFunc(tokenAuth, "DELETE /api/recs/{pointId}/history", hisController.deleteHis)
 	handleFunc(tokenAuth, "GET /api/recs/{pointId}/current", currentController.getCurrent)
 	handleFunc(tokenAuth, "POST /api/recs/{pointId}/current", currentController.postCurrent)
-	server.Handle("/api/his/", authMiddleware(serverConfig.jwtSecret, tokenAuth))
-	server.Handle("/api/recs", authMiddleware(serverConfig.jwtSecret, tokenAuth))
-	server.Handle("/api/recs/", authMiddleware(serverConfig.jwtSecret, tokenAuth))
+	server.Handle("/api/his/", authMiddleware(serverConfig.jwtSecret, serverConfig.apiKey, tokenAuth))
+	server.Handle("/api/recs", authMiddleware(serverConfig.jwtSecret, serverConfig.apiKey, tokenAuth))
+	server.Handle("/api/recs/", authMiddleware(serverConfig.jwtSecret, serverConfig.apiKey, tokenAuth))
 
 	// Catch all others with public files. Not found fallback is app index for browser router.
 	server.Handle("/app/", fileServerWithFallback(http.Dir("./public"), "./public/app/index.html"))

server_test.go

@@ -45,6 +45,7 @@ func (suite *ServerTestSuite) SetupTest() {
 		authenticator:        authenticator,
 		jwtSecret:            "aaa",
 		tokenDurationSeconds: 60,
+		apiKey:               "valid",
 
 		historyStore: historyStore,
 		recStore:     recStore,
@@ -91,6 +92,26 @@ func (suite *ServerTestSuite) TestGetAuthTokenInvalidPassword() {
 	assert.Equal(suite.T(), response.Code, http.StatusForbidden)
 }
 
+func (suite *ServerTestSuite) TestApiKey() {
+	request, _ := http.NewRequest(http.MethodGet, "/api/recs", nil)
+	request.Header.Add("Authorization", fmt.Sprintf("ApiKey %s", "valid"))
+	response := httptest.NewRecorder()
+
+	suite.server.ServeHTTP(response, request)
+
+	assert.Equal(suite.T(), http.StatusOK, response.Code)
+}
+
+func (suite *ServerTestSuite) TestApiKeyInvalid() {
+	request, _ := http.NewRequest(http.MethodGet, "/api/recs", nil)
+	request.Header.Add("Authorization", fmt.Sprintf("ApiKey %s", "invalid"))
+	response := httptest.NewRecorder()
+
+	suite.server.ServeHTTP(response, request)
+
+	assert.Equal(suite.T(), http.StatusUnauthorized, response.Code)
+}
+
 func (suite *ServerTestSuite) TestGetHis() {
 	// Insert data for 2 different points with varying timestamps
 	pointId1 := uuid.New()