MrKalzu/kalzu-value-store
1
0
Fork 0
forked from ryyst/kalzu-value-store
Code Pull Requests Activity

fix: secure admin endpoints with authentication middleware (issue #4)

Browse Source 
- Add config parameter to AuthService constructor
- Implement proper config-based auth checks in middleware
- Wrap all admin endpoints (users, groups, tokens) with authentication
- Apply granular scopes: admin:users:*, admin:groups:*, admin:tokens:*
- Maintain backward compatibility when config is nil

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
ryyst
2025-09-21 12:15:38 +03:00
parent 3aff0ab5ef
commit e6d87d025f
4 changed files with 45 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
auth/auth.go
View File

@@ -26,13 +26,15 @@ type AuthContext struct {
type AuthService struct {
db *badger.DB
logger *logrus.Logger
config *types.Config
}
// NewAuthService creates a new authentication service
func NewAuthService(db *badger.DB, logger *logrus.Logger) *AuthService {
func NewAuthService(db *badger.DB, logger *logrus.Logger, config *types.Config) *AuthService {
return &AuthService{
db: db,
logger: logger,
config: config,
}
}

9
auth/middleware.go
View File

@@ -138,11 +138,12 @@ func (s *RateLimitService) RateLimitMiddleware(next http.HandlerFunc) http.Handl
}
}
// isAuthEnabled checks if authentication is enabled (would be passed from config)
// isAuthEnabled checks if authentication is enabled from config
func (s *AuthService) isAuthEnabled() bool {
// This would normally be injected from config, but for now we'll assume enabled
// TODO: Inject config dependency
return true
if s.config != nil {
return s.config.AuthEnabled
}
return true // Default to enabled if no config
}
// Helper method to check rate limits (simplified version)

48
server/routes.go
View File

@@ -32,20 +32,44 @@ func (s *Server) setupRoutes() *mux.Router {
// Authentication and user management endpoints (available when auth is enabled)
if s.config.AuthEnabled {
// User Management endpoints
router.HandleFunc("/api/users", s.createUserHandler).Methods("POST")
router.HandleFunc("/api/users/{uuid}", s.getUserHandler).Methods("GET")
router.HandleFunc("/api/users/{uuid}", s.updateUserHandler).Methods("PUT")
router.HandleFunc("/api/users/{uuid}", s.deleteUserHandler).Methods("DELETE")
// User Management endpoints (with authentication middleware)
router.Handle("/api/users", s.authService.Middleware(
[]string{"admin:users:create"}, nil, "",
)(s.createUserHandler)).Methods("POST")
router.Handle("/api/users/{uuid}", s.authService.Middleware(
[]string{"admin:users:read"}, nil, "",
)(s.getUserHandler)).Methods("GET")
router.Handle("/api/users/{uuid}", s.authService.Middleware(
[]string{"admin:users:update"}, nil, "",
)(s.updateUserHandler)).Methods("PUT")
router.Handle("/api/users/{uuid}", s.authService.Middleware(
[]string{"admin:users:delete"}, nil, "",
)(s.deleteUserHandler)).Methods("DELETE")
// Group Management endpoints
router.HandleFunc("/api/groups", s.createGroupHandler).Methods("POST")
router.HandleFunc("/api/groups/{uuid}", s.getGroupHandler).Methods("GET")
router.HandleFunc("/api/groups/{uuid}", s.updateGroupHandler).Methods("PUT")
router.HandleFunc("/api/groups/{uuid}", s.deleteGroupHandler).Methods("DELETE")
// Group Management endpoints (with authentication middleware)
router.Handle("/api/groups", s.authService.Middleware(
[]string{"admin:groups:create"}, nil, "",
)(s.createGroupHandler)).Methods("POST")
router.Handle("/api/groups/{uuid}", s.authService.Middleware(
[]string{"admin:groups:read"}, nil, "",
)(s.getGroupHandler)).Methods("GET")
router.Handle("/api/groups/{uuid}", s.authService.Middleware(
[]string{"admin:groups:update"}, nil, "",
)(s.updateGroupHandler)).Methods("PUT")
router.Handle("/api/groups/{uuid}", s.authService.Middleware(
[]string{"admin:groups:delete"}, nil, "",
)(s.deleteGroupHandler)).Methods("DELETE")
// Token Management endpoints
router.HandleFunc("/api/tokens", s.createTokenHandler).Methods("POST")
// Token Management endpoints (with authentication middleware)
router.Handle("/api/tokens", s.authService.Middleware(
[]string{"admin:tokens:create"}, nil, "",
)(s.createTokenHandler)).Methods("POST")
}
// Revision History endpoints (available when revision history is enabled)

2
server/server.go
View File

@@ -118,7 +118,7 @@ func NewServer(config *types.Config) (*Server, error) {
server.revisionService = storage.NewRevisionService(storageService)
// Initialize authentication service
server.authService = auth.NewAuthService(db, logger)
server.authService = auth.NewAuthService(db, logger, config)
// Setup initial root account if needed (Issue #3)
if config.AuthEnabled {