feat: adds jwt auth token middleware

acceptance/acceptance_suite_test.go

@@ -2,9 +2,11 @@ package acceptance_test
 
 import (
 	"bytes"
+	"encoding/json"
 	"log"
 	"net"
 	"net/http"
+	"net/url"
 	"os"
 	"source-score/pkg/api"
 	"source-score/pkg/helpers"
@@ -32,10 +34,14 @@ const (
 )
 
 var (
-	baseUrl        string
-	commonHeaders  = map[string]string{"X-API-Key": "demo-api-key"}
-	client         = &http.Client{Timeout: 10 * time.Second}
-	serverPort     = os.Getenv("PORT")
+	baseUrl string
+	token   string
+
+	commonHeaders = map[string]string{
+		"Client-ID": "ac-tests",
+	}
+	client       = &http.Client{Timeout: 10 * time.Second}
+	serverPort   = os.Getenv("PORT")
 	sourceInput1 = api.SourceInput{
 		Name:    "Sample Source 1",
 		Summary: "Sample summary",
@@ -130,6 +136,25 @@ func TestSourceScore(t *testing.T) {
 
 	baseUrl = "http://" + helpers.Localhost + ":" + serverPort
 
+	var _ = BeforeSuite(func() {
+		endpoint, err := url.JoinPath(baseUrl, "/auth/token")
+		Expect(err).To(BeNil())
+
+		resp, err := doRequest(http.MethodGet, endpoint, nil)
+		Expect(err).To(BeNil())
+		Expect(resp.StatusCode).To(Equal(http.StatusOK))
+
+		defer resp.Body.Close()
+		var tokenResp map[string]string
+		err = json.NewDecoder(resp.Body).Decode(&tokenResp)
+		Expect(err).To(BeNil())
+
+		token = tokenResp["token"]
+		Expect(token).ToNot(Equal(""))
+
+		commonHeaders["Authorization"] = "Bearer " + token
+	})
+
 	RegisterFailHandler(Fail)
 	RunSpecs(t, "SourceScore Acceptance Test Suite")
 }

acceptance/compose.yaml

@@ -24,7 +24,6 @@ services:
     - APP_USER_PASSWORD=sourcescore
     - PG_HOST=database
     - SUPER_USER_PASSWORD=sourcescore
-    - API_KEY=demo-api-key
     - RATE_LIMIT_DISABLED=true
     ports:
     - "8080:8080"

api/source-score.yaml

@@ -5,20 +5,54 @@ info:
   version: 0.1.0
 
 servers:
-  - url: /
-    description: Current host
+- url: /
+  description: Current host
 
 security:
-  - ApiKeyAuth: []
+- BearerAuth: []
 
 paths:
+  /auth/token:
+    get:
+      summary: Obtain API token
+      description: Authenticates a user and returns an API token for subsequent requests
+      tags:
+      - authentication
+      security: []
+      operationId: getAuthToken
+      parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
+      responses:
+        200:
+          description: Authentication successful, token returned
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  token:
+                    type: string
+                    description: API token to be used in the Authorization header for authenticated requests
+        401:
+          description: Authentication failed, invalid client ID
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  error:
+                    type: string
+                    description: Error message
+
   /api/v1/sources:
     get:
       summary: Get all sources
       description: Retrieves a list of all registered information sources
       tags:
       - sources
       operationId: getSources
+      parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
       responses:
         200:
           description: List of sources retrieved successfully
@@ -36,6 +70,8 @@ paths:
       tags:
       - sources
       operationId: updateAllScores
+      parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
       responses:
         202:
           description: Score update process initiated successfully
@@ -49,6 +85,8 @@ paths:
       tags:
       - source
       operationId: postSource
+      parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
       requestBody:
         required: true
         content:
@@ -75,6 +113,7 @@ paths:
       - source
       operationId: getSource
       parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
       - in: path
         name: uriDigest
         required: true
@@ -95,9 +134,10 @@ paths:
       summary: Update source fields
       description: Partially updates a source. Only provided fields will be updated. Empty values are not allowed.
       tags:
-        - source
+      - source
       operationId: patchSource
       parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
       - in: path
         name: uriDigest
         required: true
@@ -125,6 +165,7 @@ paths:
       - source
       operationId: deleteSource
       parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
       - in: path
         name: uriDigest
         required: true
@@ -145,6 +186,7 @@ paths:
       - claims
       operationId: getClaimsBySourceDigest
       parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
       - in: path
         name: uriDigest
         required: true
@@ -169,6 +211,7 @@ paths:
       - claims
       operationId: getClaims
       parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
       - name: checked
         in: query
         schema:
@@ -193,6 +236,8 @@ paths:
       tags:
       - claims
       operationId: verifyAllClaims
+      parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
       responses:
         202:
           description: Claim verification process initiated successfully
@@ -206,6 +251,8 @@ paths:
       tags:
       - claim
       operationId: postClaim
+      parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
       requestBody:
         required: true
         content:
@@ -228,6 +275,7 @@ paths:
       - claim
       operationId: getClaim
       parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
       - in: path
         name: uriDigest
         required: true
@@ -251,6 +299,7 @@ paths:
       - claim
       operationId: deleteClaim
       parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
       - in: path
         name: uriDigest
         required: true
@@ -270,6 +319,7 @@ paths:
         - claim
       operationId: patchClaim
       parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
       - in: path
         name: uriDigest
         required: true
@@ -297,6 +347,7 @@ paths:
       - claim
       operationId: verifyClaim
       parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
       - in: path
         name: uriDigest
         required: true
@@ -325,6 +376,7 @@ paths:
       - proofs
       operationId: getProofsByClaimDigest
       parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
       - in: path
         name: uriDigest
         required: true
@@ -348,6 +400,8 @@ paths:
       tags:
       - proofs
       operationId: getProofs
+      parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
       responses:
         200:
           description: List of proofs retrieved successfully
@@ -365,6 +419,8 @@ paths:
       tags:
       - proof
       operationId: postProof
+      parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
       requestBody:
         required: true
         content:
@@ -387,6 +443,7 @@ paths:
       - proof
       operationId: getProof
       parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
       - in: path
         name: uriDigest
         required: true
@@ -410,6 +467,7 @@ paths:
       - proof
       operationId: deleteProof
       parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
       - in: path
         name: uriDigest
         required: true
@@ -426,9 +484,10 @@ paths:
       summary: Update proof reviewer
       description: Updates the reviewer identifier for a proof. Empty values and spaces are not allowed.
       tags:
-        - proof
+      - proof
       operationId: patchProof
       parameters:
+      - $ref: '#/components/parameters/ClientIDHeader'
       - in: path
         name: uriDigest
         required: true
@@ -451,10 +510,19 @@ paths:
 
 components:
   securitySchemes:
-    ApiKeyAuth:
-      type: apiKey
+    BearerAuth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+
+  parameters:
+    ClientIDHeader:
+      name: Client-ID
       in: header
-      name: X-API-Key
+      required: true
+      schema:
+        type: string
+      description: Client identifier for authentication
 
   schemas:
     SourceInput:

cmd/app/main.go

@@ -79,7 +79,7 @@ func main() {
 	server.Use(cors.New(cors.Config{
 		AllowOrigins:     []string{"https://satyalens.github.io"},
 		AllowMethods:     []string{"GET", "OPTIONS"},
-		AllowHeaders:     []string{"Content-Type", "X-API-Key"},
+		AllowHeaders:     []string{"Content-Type", "Authorization"},
 		AllowCredentials: true,
 	}))
 
@@ -99,12 +99,17 @@ func main() {
 		serverOpts.Middlewares = append(serverOpts.Middlewares, api.MiddlewareFunc(middleware.RateLimiterMiddleware(10, 20)))
 	}
 
-	// Secure with API key if the env var is set
-	if key, ok := os.LookupEnv("API_KEY"); ok {
-		slog.Info("API Key found, securing the API")
-		// server.Use(middleware.APIKeyMiddleware(key))
-		serverOpts.Middlewares = append(serverOpts.Middlewares, api.MiddlewareFunc(middleware.APIKeyMiddleware(key)))
-	}
+	authTokenMiddleware := middleware.AuthTokenMiddleware(conf.Cfg.JwtSecret)
+	serverOpts.Middlewares = append(
+		serverOpts.Middlewares,
+		func(c *gin.Context) {
+			if c.FullPath() == "/auth/token" {
+				c.Next()
+			} else {
+				authTokenMiddleware(c)
+			}
+		},
+	)
 
 	api.RegisterHandlersWithOptions(
 		server,

go.mod

@@ -4,6 +4,7 @@ go 1.25.0
 
 require (
 	github.com/gin-gonic/gin v1.12.0
+	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/golangci/golangci-lint/v2 v2.10.1
 	github.com/oapi-codegen/oapi-codegen/v2 v2.5.1
 	github.com/oapi-codegen/runtime v1.3.0

go.sum

@@ -283,6 +283,8 @@ github.com/godoc-lint/godoc-lint v0.11.2/go.mod h1:iVpGdL1JCikNH2gGeAn3Hh+AgN5Gx
 github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
 github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
+github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=