Add API key authentication to ApiServer

.env.sample

@@ -0,0 +1,6 @@
+# ==============================================================================
+# APIS_WEB APPLICATION CONFIGURATION (SAMPLE)
+# Copy this file to '.env' and fill in your actual local configuration.
+# ==============================================================================
+
+DEV_INTERNAL_API_KEY="replace-with-a-generated-secret" # openssl rand -hex 32

.gitignore

@@ -10,3 +10,6 @@ build
 *.log.lck
 *.err
 *.err.lck
+.env
+.env.local
+.env.*.local

Makefile

@@ -1,7 +1,6 @@
-
 package:
 	mvn package
 
 clean:
 	mvn clean
-	rm -f *.log *.err
+	rm -f *.log *.err

exe/config.json

@@ -19,7 +19,8 @@
 		"port" : 43900
 	},
 	"apiServer" : {
-		"port" : 9999
+		"port" : 9999,
+		"apiKey":"DEV_INTERNAL_API_KEY"
 	},
 
 	"watchdog" : {

src/main/java/jp/co/sony/csl/dcoes/apis/tools/web/ApiServer.java

@@ -13,6 +13,7 @@
 import jp.co.sony.csl.dcoes.apis.tools.web.api_handler.DealGeneration;
 import jp.co.sony.csl.dcoes.apis.tools.web.api_handler.ErrorGeneration;
 import jp.co.sony.csl.dcoes.apis.tools.web.api_handler.LogConfiguration;
+import java.security.MessageDigest;
 
 /**
  * These Verticles provide various Web API for controlling APIS from the
@@ -69,6 +70,7 @@ public class ApiServer extends AbstractVerticle {
 	 * @param startFuture {@inheritDoc}
 	 * @throws Exception {@inheritDoc}
 	 */
+
 	@Override
 	public void start(Promise<Void> startPromise) throws Exception {
 		startHttpService_(resHttp -> {
@@ -95,6 +97,39 @@ public void stop() throws Exception {
 			log.trace("stopped : " + deploymentID());
 	}
 
+
+	/**
+	 * Starts authenticates request to our server.
+	 * Gets providedKey from request and authenticates, by matching with our servers apiKey.
+	 * 
+	 * @param req the request object hitting our server
+	 * @param apiKey the configured apiKey from our server
+	 */
+	static Integer checkAuth(HttpServerRequest req, String apiKey) {
+
+		if (apiKey == null || apiKey.isEmpty()) {
+			return 500;
+		}
+
+		if (apiKey.startsWith("DEV_INTERNAL")){
+			apiKey = System.getenv("DEV_INTERNAL_API_KEY");
+			if (apiKey == null || apiKey.isEmpty()) {
+			return 500;
+			}
+		}
+
+		String providedKey = req.getHeader("X-API-Key");
+
+		if (providedKey == null || !MessageDigest.isEqual(apiKey.getBytes(), providedKey.getBytes())) {
+			return 401;
+		}
+
+		return null; // auth passed
+	}
+
+
+
+
 	////
 
 	/**
@@ -110,12 +145,27 @@ public void stop() throws Exception {
 	 */
 	private void startHttpService_(Handler<AsyncResult<Void>> completionHandler) {
 		Integer port = VertxConfig.config.getInteger(DEFAULT_PORT, "apiServer", "port");
+		// fetches the config api-key
+		String apiKey = VertxConfig.apiServerApiKey();
+
+
 		vertx.createHttpServer().requestHandler(req -> {
 			req.exceptionHandler(t -> {
 				log.error("exceptionHandler", t);
 				req.response().setChunked(true).putHeader("content-type", "text/plain").setStatusCode(500)
 						.end("exceptionHandler : " + t + '\n');
 			});
+
+
+			// --- start auth check ---
+			Integer authFail = checkAuth(req, apiKey);
+			if (authFail != null) {
+				req.response().setStatusCode(authFail).end(authFail == 500 ? "server misconfigured\n" : "unauthorized\n");
+				return;
+			}
+			// --- end auth check ---
+
+
 			try {
 				for (ApiHandler apiHandler : apiHandlers_) {
 					if (apiHandler.canHandleRequest(req)) {

src/test/java/jp/co/sony/csl/dcoes/apis/tools/web/ApiServerAuthTest.java

@@ -0,0 +1,45 @@
+package jp.co.sony.csl.dcoes.apis.tools.web;
+
+import io.vertx.core.http.HttpServerRequest;
+import org.junit.Test;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+
+public class ApiServerAuthTest {
+
+    @Test
+    public void nullApiKey_returns500() {
+        HttpServerRequest req = mock(HttpServerRequest.class);
+        assertEquals(Integer.valueOf(500), ApiServer.checkAuth(req, null));
+    }
+
+    @Test
+    public void emptyApiKey_returns500() {
+        HttpServerRequest req = mock(HttpServerRequest.class);
+        assertEquals(Integer.valueOf(500), ApiServer.checkAuth(req, ""));
+    }
+
+    @Test
+    public void missingHeader_returns401() {
+        HttpServerRequest req = mock(HttpServerRequest.class);
+        when(req.getHeader("X-API-Key")).thenReturn(null);
+        assertEquals(Integer.valueOf(401), ApiServer.checkAuth(req, "secret"));
+    }
+
+    @Test
+    public void wrongKey_returns401() {
+        HttpServerRequest req = mock(HttpServerRequest.class);
+        when(req.getHeader("X-API-Key")).thenReturn("wrong");
+        assertEquals(Integer.valueOf(401), ApiServer.checkAuth(req, "secret"));
+    }
+
+    @Test
+    public void correctKey_returnsNull() {
+        HttpServerRequest req = mock(HttpServerRequest.class);
+        when(req.getHeader("X-API-Key")).thenReturn("secret");
+        assertNull(ApiServer.checkAuth(req, "secret"));
+    }
+}