Add Configuration for Anonymous Read and Write Access to KV Endpoints #5

New Issue

MrKalzu · 2025-09-12T22:27:36+03:00

MrKalzu commented

2025-09-12 22:27:36 +03:00

Currently, the /kv/{path} endpoints for GET and PUT operations are publicly accessible without any authentication. While this might be desired in some scenarios for a simple key-value store, it lacks the flexibility to secure these core data access points. Many deployments will require all data access to be authenticated and authorized.

Proposed Solution:
Introduce two new configuration parameters in the Config struct:

AllowAnonymousRead (boolean, default false): If true, GET /kv/{path} requests will not require authentication.
AllowAnonymousWrite (boolean, default false): If true, PUT /kv/{path} requests will not require authentication.

Modify the setupRoutes function to conditionally apply the authMiddleware to the getKVHandler and putKVHandler based on these configuration flags.

If AllowAnonymousRead is false, apply authMiddleware with a "read" scope requirement to getKVHandler.
If AllowAnonymousWrite is false, apply authMiddleware with a "write" scope requirement to putKVHandler.
The deleteKVHandler should always require authentication and appropriate scopes (e.g., "delete").

This provides granular control over public access to the core key-value store functionality.

Relevant Code Sections:

Config struct for new fields.
setupRoutes function to apply middleware conditionally.
getKVHandler, putKVHandler, deleteKVHandler functions.
authMiddleware function.

Currently, the `/kv/{path}` endpoints for `GET` and `PUT` operations are publicly accessible without any authentication. While this might be desired in some scenarios for a simple key-value store, it lacks the flexibility to secure these core data access points. Many deployments will require all data access to be authenticated and authorized. **Proposed Solution:** Introduce two new configuration parameters in the `Config` struct: * `AllowAnonymousRead` (boolean, default `false`): If `true`, `GET /kv/{path}` requests will not require authentication. * `AllowAnonymousWrite` (boolean, default `false`): If `true`, `PUT /kv/{path}` requests will not require authentication. Modify the `setupRoutes` function to conditionally apply the `authMiddleware` to the `getKVHandler` and `putKVHandler` based on these configuration flags. * If `AllowAnonymousRead` is `false`, apply `authMiddleware` with a "read" scope requirement to `getKVHandler`. * If `AllowAnonymousWrite` is `false`, apply `authMiddleware` with a "write" scope requirement to `putKVHandler`. * The `deleteKVHandler` should always require authentication and appropriate scopes (e.g., "delete"). This provides granular control over public access to the core key-value store functionality. **Relevant Code Sections:** * `Config` struct for new fields. * `setupRoutes` function to apply middleware conditionally. * `getKVHandler`, `putKVHandler`, `deleteKVHandler` functions. * `authMiddleware` function.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: ryyst/kalzu-value-store#5