hermes-agent
5647e5642a
Build, Lint, and Test / Build, Lint, and Test (push) Failing after 1m21s
- Remove unused aliases that caused warnings-as-errors in EX_CHECK mode - Run mix format to fix formatter check - Add root-level yarn install to CI for prettier (used by mix check) - All 1007 tests pass, zero warnings
50 lines
1.2 KiB
Elixir
50 lines
1.2 KiB
Elixir
defmodule PinchflatWeb.ApiAuthPlug do
|
|
@moduledoc """
|
|
Authenticates API requests using a Bearer token.
|
|
|
|
The token is read from the `PINCHFLAT_API_TOKEN` environment variable.
|
|
If the environment variable is not set, API authentication is disabled
|
|
(useful for development and testing). In production, you should always
|
|
set this to a secure value.
|
|
|
|
Clients should send the token in the Authorization header:
|
|
Authorization: Bearer <token>
|
|
"""
|
|
|
|
import Plug.Conn
|
|
|
|
def init(opts), do: opts
|
|
|
|
def call(conn, _opts) do
|
|
expected_token = Application.get_env(:pinchflat, :api_token)
|
|
|
|
if credential_set?(expected_token) do
|
|
case get_req_header(conn, "authorization") do
|
|
["Bearer " <> token] ->
|
|
if String.trim(token) == expected_token do
|
|
conn
|
|
else
|
|
send_unauthorized(conn)
|
|
end
|
|
|
|
_ ->
|
|
send_unauthorized(conn)
|
|
end
|
|
else
|
|
# No API token configured — allow access (dev/test mode)
|
|
conn
|
|
end
|
|
end
|
|
|
|
defp credential_set?(credential) do
|
|
credential && credential != ""
|
|
end
|
|
|
|
defp send_unauthorized(conn) do
|
|
conn
|
|
|> put_resp_content_type("application/json")
|
|
|> send_resp(401, ~s({"errors":{"detail":"Unauthorized"}}))
|
|
|> halt()
|
|
end
|
|
end
|