implement authentication through an auth-token

5 files changed, 86 insertions, 41 deletions

diff --git a/clams-server/src/main/java/no/eliashaugsbakk/clams/server/config/AppConfig.java b/clams-server/src/main/java/no/eliashaugsbakk/clams/server/config/AppConfig.java
index 1d68166..ada9847 100644
--- a/clams-server/src/main/java/no/eliashaugsbakk/clams/server/config/AppConfig.java
+++ b/clams-server/src/main/java/no/eliashaugsbakk/clams/server/config/AppConfig.java
@@ -5,6 +5,8 @@ import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
+import java.security.SecureRandom;
+import java.util.Base64;
 import java.util.Properties;
 
 public class AppConfig {
@@ -23,7 +25,7 @@ public class AppConfig {
       properties.load(reader);
       ensureStorageDirectoryExists();
     } catch (IOException e) {
-      System.err.println("Failed to load configuration file: " + e.getMessage());
+      throw new RuntimeException("Failed to read configuration file: " + configPath, e);
     }
   }
 
@@ -43,10 +45,19 @@ public class AppConfig {
     try {
       Files.createDirectories(configPath.getParent());
 
+      byte[] tokenBytes = new byte[32];
+      new SecureRandom().nextBytes(tokenBytes);
+      String token = Base64.getUrlEncoder().withoutPadding().encodeToString(tokenBytes);
+
       try (BufferedWriter writer = Files.newBufferedWriter(configPath)) {
-        writer.write("storage_location=./data/\n\n");
+        writer.write(String.format("""
+            storage_location=./data/
+            
+            authorization_token=%s
+            """, token));
       }
-      System.out.println("Generated a default configuration file at: " + configPath);
+      IO.println("Generated a default configuration file at: " + configPath);
+      IO.println("Generated authentication token: " + token);
 
     } catch (IOException e) {
       System.err.println("Could not create default config file: " + e.getMessage());
@@ -56,4 +67,14 @@ public class AppConfig {
   public String getStorageLocation() {
     return properties.getProperty("storage_location", "./data");
   }
+
+  public String getAuthToken() {
+    String token = properties.getProperty("authorization_token");
+    if (token == null || token.isBlank()) {
+      System.err.println("CRITICAL: 'authorization_token' is missing or empty in config properties!");
+
+      throw new IllegalStateException("CRITICAL: 'authorization_token' is missing or empty in config properties!");
+    }
+    return token;
+  }
 }
diff --git a/clams-server/src/main/java/no/eliashaugsbakk/clams/server/config/AppContext.java b/clams-server/src/main/java/no/eliashaugsbakk/clams/server/config/AppContext.java
index c5ef242..9f88053 100644
--- a/clams-server/src/main/java/no/eliashaugsbakk/clams/server/config/AppContext.java
+++ b/clams-server/src/main/java/no/eliashaugsbakk/clams/server/config/AppContext.java
@@ -9,6 +9,7 @@ import no.eliashaugsbakk.clams.server.repository.BlogPostRepoSqlite;
 import no.eliashaugsbakk.clams.server.repository.MediaRepo;
 import no.eliashaugsbakk.clams.server.repository.MediaRepoSqlite;
 import no.eliashaugsbakk.clams.server.repository.SqliteManager;
+import no.eliashaugsbakk.clams.server.service.AuthService;
 import no.eliashaugsbakk.clams.server.service.SlugService;
 
 public class AppContext implements AutoCloseable {
@@ -16,6 +17,7 @@ public class AppContext implements AutoCloseable {
   private final BlogController blogController;
   private final MediaController mediaController;
   private final PostController postController;
+  private final AuthService authService;
 
   public AppContext() {
     AppConfig appConfig = new AppConfig();
@@ -32,11 +34,13 @@ public class AppContext implements AutoCloseable {
     this.blogController = new BlogController(dbManager);
     this.mediaController = new MediaController(mediaRepo, appConfig);
     this.postController = new PostController(blogPostRepo, slugService);
+    this.authService = new AuthService(appConfig);
   }
 
   public BlogController getBlogController() { return blogController; }
   public MediaController getMediaController() { return mediaController; }
   public PostController getPostController() { return postController; }
+  public AuthService getAuthService() { return authService; }
 
   @Override
   public void close() {
diff --git a/clams-server/src/main/java/no/eliashaugsbakk/clams/server/config/AppRoutes.java b/clams-server/src/main/java/no/eliashaugsbakk/clams/server/config/AppRoutes.java
index fb42dfc..fb5c936 100644
--- a/clams-server/src/main/java/no/eliashaugsbakk/clams/server/config/AppRoutes.java
+++ b/clams-server/src/main/java/no/eliashaugsbakk/clams/server/config/AppRoutes.java
@@ -1,14 +1,20 @@
 package no.eliashaugsbakk.clams.server.config;
 
-import static io.javalin.apibuilder.ApiBuilder.*;
+import static io.javalin.apibuilder.ApiBuilder.before;
+import static io.javalin.apibuilder.ApiBuilder.delete;
+import static io.javalin.apibuilder.ApiBuilder.get;
+import static io.javalin.apibuilder.ApiBuilder.path;
+import static io.javalin.apibuilder.ApiBuilder.post;
+import static io.javalin.apibuilder.ApiBuilder.put;
+
 import io.javalin.apibuilder.EndpointGroup;
 import java.util.Map;
 
 public class AppRoutes implements EndpointGroup {
-  private final AppContext ctx;
+  private final AppContext appContext;
 
-  public AppRoutes(AppContext ctx) {
-    this.ctx = ctx;
+  public AppRoutes(AppContext appContext) {
+    this.appContext = appContext;
   }
 
   @Override
@@ -20,19 +26,38 @@ public class AppRoutes implements EndpointGroup {
         Map.of("page_title", "Projects - Elias Haugsbakk", "page_css", "projects")));
 
     path("blog", () -> {
-      get(ctx.getBlogController()::handleBlogRequest);
-      get("{slug}", ctx.getBlogController()::handleGetPost);
+      get(appContext.getBlogController()::handleBlogRequest);
+      get("{slug}", appContext.getBlogController()::handleGetPost);
     });
 
     path("api", () -> {
-      post("posts", ctx.getPostController()::handlePostPost);
-      put("posts/{slug}", ctx.getPostController()::handlePutPost);
-      delete("posts/{slug}", ctx.getPostController()::handleDeletePost);
-
-      get("media", ctx.getMediaController()::handleGetMediaIndex);
-      get("media/{uuid}", ctx.getMediaController()::handleGetMedia);
-      post("media", ctx.getMediaController()::handlePostMedia);
-      delete("media/{uuid}", ctx.getMediaController()::handleDeleteMedia);
+      before("*", ctx -> {
+        String authHeader = ctx.header("Authorization");
+
+        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
+          ctx.status(401).json(Map.of("error", "Unauthorized",
+              "message", "Missing or malformed Authorization header."));
+          ctx.skipRemainingHandlers();
+          return;
+        }
+
+        String token = authHeader.substring(7).trim();
+        if (!appContext.getAuthService().isValid(token)) {
+          ctx.status(403)
+              .json(Map.of("error", "Forbidden",
+                  "message", "Invalid API validation token."));
+          ctx.skipRemainingHandlers();
+        }
+      });
+
+      post("posts", appContext.getPostController()::handlePostPost);
+      put("posts/{slug}", appContext.getPostController()::handlePutPost);
+      delete("posts/{slug}", appContext.getPostController()::handleDeletePost);
+
+      get("media", appContext.getMediaController()::handleGetMediaIndex);
+      get("media/{uuid}", appContext.getMediaController()::handleGetMedia);
+      post("media", appContext.getMediaController()::handlePostMedia);
+      delete("media/{uuid}", appContext.getMediaController()::handleDeleteMedia);
     });
   }
 }
diff --git a/clams-server/src/main/java/no/eliashaugsbakk/clams/server/repository/SqliteManager.java b/clams-server/src/main/java/no/eliashaugsbakk/clams/server/repository/SqliteManager.java
index a192cee..06a4ee2 100644
--- a/clams-server/src/main/java/no/eliashaugsbakk/clams/server/repository/SqliteManager.java
+++ b/clams-server/src/main/java/no/eliashaugsbakk/clams/server/repository/SqliteManager.java
@@ -38,27 +38,6 @@ public class SqliteManager implements AutoCloseable {
         );
         """;
 
-    String idxPublished = """
-        CREATE INDEX IF NOT EXISTS idx_posts_published ON posts(published DESC);
-        """;
-
-    String tags = """
-        CREATE TABLE IF NOT EXISTS tags (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          name TEXT NOT NULL UNIQUE
-        );
-        """;
-
-    String post_tags = """
-        CREATE TABLE IF NOT EXISTS post_tags (
-            post_id INTEGER,
-            tag_id INTEGER,
-            PRIMARY KEY (post_id, tag_id),
-            FOREIGN KEY (post_id) REFERENCES posts(id) ON DELETE CASCADE,
-            FOREIGN KEY (tag_id) REFERENCES tags(id) ON DELETE CASCADE
-        );
-        """;
-
     String images = """
         CREATE TABLE IF NOT EXISTS images (
             uuid TEXT PRIMARY KEY,
@@ -71,9 +50,6 @@ public class SqliteManager implements AutoCloseable {
     try (Connection conn = dataSource.getConnection(); Statement stmt = conn.createStatement()) {
 
       stmt.execute(posts);
-      stmt.execute(idxPublished);
-      stmt.execute(tags);
-      stmt.execute(post_tags);
       stmt.execute(images);
 
     } catch (SQLException e) {
diff --git a/clams-server/src/main/java/no/eliashaugsbakk/clams/server/service/AuthService.java b/clams-server/src/main/java/no/eliashaugsbakk/clams/server/service/AuthService.java
new file mode 100644
index 0000000..e52613b
--- /dev/null
+++ b/clams-server/src/main/java/no/eliashaugsbakk/clams/server/service/AuthService.java
@@ -0,0 +1,19 @@
+package no.eliashaugsbakk.clams.server.service;
+
+import no.eliashaugsbakk.clams.server.config.AppConfig;
+
+public class AuthService {
+  private final String tokenHash;
+
+  public AuthService(AppConfig appConfig) {
+    this.tokenHash = appConfig.getAuthToken();
+  }
+
+  public boolean isValid(String incomingToken) {
+    if (incomingToken == null || incomingToken.isBlank()) {
+      return false;
+    }
+
+    return incomingToken.equals(tokenHash);
+  }
+}