downloads API, UI

cmd/dkl-local-server/auth.go

@@ -26,11 +26,32 @@ func authorizeToken(r *http.Request, token string) bool {
 	}
 
 	reqToken := r.Header.Get("Authorization")
+	if reqToken != "" {
+		return reqToken == "Bearer "+token
+	}
 
-	return reqToken == "Bearer "+token
+	return r.URL.Query().Get("token") == token
 }
 
 func forbidden(w http.ResponseWriter, r *http.Request) {
 	log.Printf("denied access to %s from %s", r.RequestURI, r.RemoteAddr)
 	http.Error(w, "Forbidden", http.StatusForbidden)
 }
+
+func requireToken(token string, handler http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		if !authorizeToken(req, token) {
+			forbidden(w, req)
+			return
+		}
+		handler.ServeHTTP(w, req)
+	})
+}
+
+func requireAdmin(handler http.Handler) http.Handler {
+	return requireToken(*adminToken, handler)
+}
+
+func requireHosts(handler http.Handler) http.Handler {
+	return requireToken(*hostsToken, handler)
+}