hermes-agent
172c1ff264
Build, Lint, and Test / Build, Lint, and Test (push) Failing after 13m0s
- Add /api/v1 namespace with Bearer token auth (PINCHFLAT_API_TOKEN env var) - API controllers for sources, media items, media profiles, settings, tasks - Support for all source actions: create, update, delete, force_download_pending, force_redownload, force_index, force_metadata_refresh, sync_files_on_disk - Media item endpoints: list, show, search, force_download, update, delete - Media profile CRUD endpoints - Settings show/update and app_info endpoints - Task listing endpoints - Add Jason.Encoder for Task schema - Comprehensive test suite for all API endpoints - Gitea Actions CI workflow (runs existing checks + API-specific tests) - API documentation in docs/API.md
50 lines
1.3 KiB
Elixir
50 lines
1.3 KiB
Elixir
defmodule PinchflatWeb.ApiAuthPlug do
|
|
@moduledoc """
|
|
Authenticates API requests using a Bearer token.
|
|
|
|
The token is read from the `PINCHFLAT_API_TOKEN` environment variable.
|
|
If the environment variable is not set, API authentication is disabled
|
|
(useful for development and testing). In production, you should always
|
|
set this to a secure value.
|
|
|
|
Clients should send the token in the Authorization header:
|
|
Authorization: Bearer <token>
|
|
"""
|
|
|
|
import Plug.Conn
|
|
alias Pinchflat.Settings
|
|
|
|
def init(opts), do: opts
|
|
|
|
def call(conn, _opts) do
|
|
expected_token = Application.get_env(:pinchflat, :api_token)
|
|
|
|
if credential_set?(expected_token) do
|
|
case get_req_header(conn, "authorization") do
|
|
["Bearer " <> token] ->
|
|
if String.trim(token) == expected_token do
|
|
conn
|
|
else
|
|
send_unauthorized(conn)
|
|
end
|
|
|
|
_ ->
|
|
send_unauthorized(conn)
|
|
end
|
|
else
|
|
# No API token configured — allow access (dev/test mode)
|
|
conn
|
|
end
|
|
end
|
|
|
|
defp credential_set?(credential) do
|
|
credential && credential != ""
|
|
end
|
|
|
|
defp send_unauthorized(conn) do
|
|
conn
|
|
|> put_resp_content_type("application/json")
|
|
|> send_resp(401, ~s({"errors":{"detail":"Unauthorized"}}))
|
|
|> halt()
|
|
end
|
|
end |