feat: protect HTTP API using access token

cmd/lassie/daemon.go

@@ -74,6 +74,11 @@ var daemonFlags = []cli.Flag{
 	FlagBitswapConcurrency,
 	FlagGlobalTimeout,
 	FlagProviderTimeout,
+	&cli.StringFlag{
+		Name:  "access-token",
+		Usage: "require HTTP clients to authorize using Bearer scheme and the configured access token",
+		Value: "",
+	},
 }
 
 var daemonCmd = &cli.Command{
@@ -119,7 +124,8 @@ func daemonAction(cctx *cli.Context) error {
 	port := cctx.Uint("port")
 	tempDir := cctx.String("tempdir")
 	maxBlocks := cctx.Uint64("maxblocks")
-	httpServerCfg := getHttpServerConfigForDaemon(address, port, tempDir, maxBlocks)
+	accessToken := cctx.String("access-token")
+	httpServerCfg := getHttpServerConfigForDaemon(address, port, tempDir, maxBlocks, accessToken)
 
 	// event recorder config
 	eventRecorderURL := cctx.String("event-recorder-url")
@@ -200,11 +206,12 @@ func defaultDaemonRun(
 }
 
 // getHttpServerConfigForDaemon returns a HttpServerConfig for the daemon command.
-func getHttpServerConfigForDaemon(address string, port uint, tempDir string, maxBlocks uint64) httpserver.HttpServerConfig {
+func getHttpServerConfigForDaemon(address string, port uint, tempDir string, maxBlocks uint64, accessToken string) httpserver.HttpServerConfig {
 	return httpserver.HttpServerConfig{
 		Address:             address,
 		Port:                port,
 		TempDir:             tempDir,
 		MaxBlocksPerRequest: maxBlocks,
+		AccessToken:         accessToken,
 	}
 }

pkg/server/http/server.go

@@ -27,6 +27,7 @@ type HttpServerConfig struct {
 	Port                uint
 	TempDir             string
 	MaxBlocksPerRequest uint64
+	AccessToken         string
 }
 
 type contextKey struct {
@@ -52,6 +53,11 @@ func NewHttpServer(ctx context.Context, lassie *lassie.Lassie, cfg HttpServerCon
 	// create server
 	mux := http.NewServeMux()
 	handler := servertiming.Middleware(mux, nil)
+
+	if cfg.AccessToken != "" {
+		handler = authorizationMiddleware(handler, cfg.AccessToken)
+	}
+
 	server := &http.Server{
 		Addr:        fmt.Sprintf(":%d", cfg.Port),
 		BaseContext: func(listener net.Listener) context.Context { return ctx },
@@ -102,3 +108,17 @@ func (s *HttpServer) Close() error {
 	s.cancel()
 	return s.server.Shutdown(context.Background())
 }
+
+func authorizationMiddleware(next http.Handler, accessToken string) http.Handler {
+	requiredHeaderValue := "Bearer " + accessToken
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Authorization") == requiredHeaderValue {
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		// Unauthorized
+		w.WriteHeader(http.StatusUnauthorized)
+		fmt.Fprintln(w, "Unauthorized")
+	})
+}