Node / rns-mirrors / Reticulum-Go.git / files / pkg / controlapi / auth.go

Displaying Raw • Download

// SPDX-License-Identifier: Apache-2.0

// Copyright (c) 2024-2026 Quad4.io

package controlapi

import (

"crypto/subtle"

"encoding/hex"

"net/http"

"strings"

)

const bearerPrefix = "Bearer "

// authMiddleware rejects any request without a valid bearer token before it

// reaches the route handlers.

func (s *Server) authMiddleware(next http.Handler) http.Handler {

return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

if !s.authorized(r) {

writeError(w, http.StatusUnauthorized, "missing or invalid bearer token")

return

}

next.ServeHTTP(w, r)

})

}

// authorized reports whether r carries a bearer token matching the server's

// hex-encoded auth key, compared in constant time.

func (s *Server) authorized(r *http.Request) bool {

header := r.Header.Get("Authorization")

if !strings.HasPrefix(header, bearerPrefix) {

return false

}

token, err := hex.DecodeString(strings.TrimPrefix(header, bearerPrefix))

if err != nil || len(token) == 0 || len(token) != len(s.authKey) {

return false

}

return subtle.ConstantTimeCompare(token, s.authKey) == 1

}