Currently, the /kv/{path} endpoints for GET and PUT operations are publicly accessible without any authentication. While this might be desired in some scenarios for a simple key-value store, it lacks the flexibility to secure these core data access points. Many deployments will require all data access to be authenticated and authorized.
Proposed Solution:
Introduce two new configuration parameters in the Config struct:
AllowAnonymousRead (boolean, default false): If true, GET /kv/{path} requests will not require authentication.
AllowAnonymousWrite (boolean, default false): If true, PUT /kv/{path} requests will not require authentication.
Modify the setupRoutes function to conditionally apply the authMiddleware to the getKVHandler and putKVHandler based on these configuration flags.
If AllowAnonymousRead is false, apply authMiddleware with a "read" scope requirement to getKVHandler.
If AllowAnonymousWrite is false, apply authMiddleware with a "write" scope requirement to putKVHandler.
The deleteKVHandler should always require authentication and appropriate scopes (e.g., "delete").
This provides granular control over public access to the core key-value store functionality.
Relevant Code Sections:
Config struct for new fields.
setupRoutes function to apply middleware conditionally.
Currently, the `/kv/{path}` endpoints for `GET` and `PUT` operations are publicly accessible without any authentication. While this might be desired in some scenarios for a simple key-value store, it lacks the flexibility to secure these core data access points. Many deployments will require all data access to be authenticated and authorized.
**Proposed Solution:**
Introduce two new configuration parameters in the `Config` struct:
* `AllowAnonymousRead` (boolean, default `false`): If `true`, `GET /kv/{path}` requests will not require authentication.
* `AllowAnonymousWrite` (boolean, default `false`): If `true`, `PUT /kv/{path}` requests will not require authentication.
Modify the `setupRoutes` function to conditionally apply the `authMiddleware` to the `getKVHandler` and `putKVHandler` based on these configuration flags.
* If `AllowAnonymousRead` is `false`, apply `authMiddleware` with a "read" scope requirement to `getKVHandler`.
* If `AllowAnonymousWrite` is `false`, apply `authMiddleware` with a "write" scope requirement to `putKVHandler`.
* The `deleteKVHandler` should always require authentication and appropriate scopes (e.g., "delete").
This provides granular control over public access to the core key-value store functionality.
**Relevant Code Sections:**
* `Config` struct for new fields.
* `setupRoutes` function to apply middleware conditionally.
* `getKVHandler`, `putKVHandler`, `deleteKVHandler` functions.
* `authMiddleware` function.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Currently, the
/kv/{path}endpoints forGETandPUToperations are publicly accessible without any authentication. While this might be desired in some scenarios for a simple key-value store, it lacks the flexibility to secure these core data access points. Many deployments will require all data access to be authenticated and authorized.Proposed Solution:
Introduce two new configuration parameters in the
Configstruct:AllowAnonymousRead(boolean, defaultfalse): Iftrue,GET /kv/{path}requests will not require authentication.AllowAnonymousWrite(boolean, defaultfalse): Iftrue,PUT /kv/{path}requests will not require authentication.Modify the
setupRoutesfunction to conditionally apply theauthMiddlewareto thegetKVHandlerandputKVHandlerbased on these configuration flags.AllowAnonymousReadisfalse, applyauthMiddlewarewith a "read" scope requirement togetKVHandler.AllowAnonymousWriteisfalse, applyauthMiddlewarewith a "write" scope requirement toputKVHandler.deleteKVHandlershould always require authentication and appropriate scopes (e.g., "delete").This provides granular control over public access to the core key-value store functionality.
Relevant Code Sections:
Configstruct for new fields.setupRoutesfunction to apply middleware conditionally.getKVHandler,putKVHandler,deleteKVHandlerfunctions.authMiddlewarefunction.