MrKalzu/kalzu-value-store
1
0
Fork 0
forked from ryyst/kalzu-value-store
Code Pull Requests Activity

fix: secure admin endpoints with authentication middleware (issue #4)

Browse Source 
- Add config parameter to AuthService constructor
- Implement proper config-based auth checks in middleware
- Wrap all admin endpoints (users, groups, tokens) with authentication
- Apply granular scopes: admin:users:*, admin:groups:*, admin:tokens:*
- Maintain backward compatibility when config is nil

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
ryyst
2025-09-21 12:15:38 +03:00
parent 3aff0ab5ef
commit e6d87d025f
4 changed files with 45 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
server/routes.go
View File

@@ -32,20 +32,44 @@ func (s *Server) setupRoutes() *mux.Router {
// Authentication and user management endpoints (available when auth is enabled)
if s.config.AuthEnabled {
// User Management endpoints
router.HandleFunc("/api/users", s.createUserHandler).Methods("POST")
router.HandleFunc("/api/users/{uuid}", s.getUserHandler).Methods("GET")
router.HandleFunc("/api/users/{uuid}", s.updateUserHandler).Methods("PUT")
router.HandleFunc("/api/users/{uuid}", s.deleteUserHandler).Methods("DELETE")
// User Management endpoints (with authentication middleware)
router.Handle("/api/users", s.authService.Middleware(
[]string{"admin:users:create"}, nil, "",
)(s.createUserHandler)).Methods("POST")
router.Handle("/api/users/{uuid}", s.authService.Middleware(
[]string{"admin:users:read"}, nil, "",
)(s.getUserHandler)).Methods("GET")
router.Handle("/api/users/{uuid}", s.authService.Middleware(
[]string{"admin:users:update"}, nil, "",
)(s.updateUserHandler)).Methods("PUT")
router.Handle("/api/users/{uuid}", s.authService.Middleware(
[]string{"admin:users:delete"}, nil, "",
)(s.deleteUserHandler)).Methods("DELETE")
// Group Management endpoints
router.HandleFunc("/api/groups", s.createGroupHandler).Methods("POST")
router.HandleFunc("/api/groups/{uuid}", s.getGroupHandler).Methods("GET")
router.HandleFunc("/api/groups/{uuid}", s.updateGroupHandler).Methods("PUT")
router.HandleFunc("/api/groups/{uuid}", s.deleteGroupHandler).Methods("DELETE")
// Group Management endpoints (with authentication middleware)
router.Handle("/api/groups", s.authService.Middleware(
[]string{"admin:groups:create"}, nil, "",
)(s.createGroupHandler)).Methods("POST")
router.Handle("/api/groups/{uuid}", s.authService.Middleware(
[]string{"admin:groups:read"}, nil, "",
)(s.getGroupHandler)).Methods("GET")
router.Handle("/api/groups/{uuid}", s.authService.Middleware(
[]string{"admin:groups:update"}, nil, "",
)(s.updateGroupHandler)).Methods("PUT")
router.Handle("/api/groups/{uuid}", s.authService.Middleware(
[]string{"admin:groups:delete"}, nil, "",
)(s.deleteGroupHandler)).Methods("DELETE")
// Token Management endpoints
router.HandleFunc("/api/tokens", s.createTokenHandler).Methods("POST")
// Token Management endpoints (with authentication middleware)
router.Handle("/api/tokens", s.authService.Middleware(
[]string{"admin:tokens:create"}, nil, "",
)(s.createTokenHandler)).Methods("POST")
}
// Revision History endpoints (available when revision history is enabled)