Add HTTP Basic authentication to the agent's API. Update OpenAPI specification to include security requirements and modify the server handler to enforce authentication. Introduce default admin credentials for access control.

lib/helpers/auth.go

@@ -0,0 +1,29 @@
+package helpers
+
+import (
+	"crypto/subtle"
+	"net/http"
+
+	"tea.chunkbyte.com/kato/go-worm/lib/config"
+)
+
+func BasicAuth(next http.Handler) http.Handler {
+	user := []byte(config.AuthUser)
+	pass := []byte(config.AuthPass)
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/openapi", "/openapi.json":
+			next.ServeHTTP(w, r)
+			return
+		}
+		u, p, ok := r.BasicAuth()
+		if !ok ||
+			subtle.ConstantTimeCompare([]byte(u), user) != 1 ||
+			subtle.ConstantTimeCompare([]byte(p), pass) != 1 {
+			w.Header().Set("WWW-Authenticate", `Basic realm="win64_mp"`)
+			WriteError(w, http.StatusUnauthorized, "unauthorized")
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}

lib/helpers/auth_test.go

@@ -0,0 +1,51 @@
+package helpers
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"tea.chunkbyte.com/kato/go-worm/lib/config"
+)
+
+func TestBasicAuth(t *testing.T) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/openapi", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+	mux.HandleFunc("/health", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+	h := BasicAuth(mux)
+
+	t.Run("openapi public", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/openapi", nil)
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != http.StatusOK {
+			t.Fatalf("status = %d, want 200", rec.Code)
+		}
+	})
+
+	t.Run("protected without creds", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/health", nil)
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != http.StatusUnauthorized {
+			t.Fatalf("status = %d, want 401", rec.Code)
+		}
+		if got := rec.Header().Get("WWW-Authenticate"); got == "" {
+			t.Fatal("missing WWW-Authenticate")
+		}
+	})
+
+	t.Run("protected with creds", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/health", nil)
+		req.SetBasicAuth(config.AuthUser, config.AuthPass)
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != http.StatusOK {
+			t.Fatalf("status = %d, want 200", rec.Code)
+		}
+	})
+}