Feature/api auth (#182)

* Add API key authentication

- Adds support for API key authentication (disabled by default) for REST API
- Code adopted from example provided by @joseftw

* Add protection to all APIs by default

- Add protection to all APIs by default, a few APIs is made public.

* Remove annotations for API methods

Author: sondreb

src/Blockcore/Controllers/ConnectionManagerController.cs

@@ -7,6 +7,7 @@
 using Blockcore.Utilities;
 using Blockcore.Utilities.Extensions;
 using Blockcore.Utilities.JsonErrors;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Logging;
 
@@ -15,6 +16,7 @@ namespace Blockcore.Controllers
     /// <summary>
     /// A <see cref="FeatureController"/> that implements API and RPC methods for the connection manager.
     /// </summary>
+    [Authorize]
     [ApiController]
     [ApiVersion("1")]
     [Route("api/[controller]")]
@@ -65,6 +67,7 @@ public IActionResult AddNode([FromQuery] string endpoint, string command)
         /// <see cref="https://github.com/bitcoin/bitcoin/blob/0.14/src/rpc/net.cpp"/>
         /// <remarks>This is an API implementation of an RPC call.</remarks>
         /// <returns>Json formatted <see cref="List{T}<see cref="PeerNodeModel"/>"/> of connected nodes. Returns <see cref="IActionResult"/> formatted error if fails.</returns>
+        [AllowAnonymous]
         [Route("getpeerinfo")]
         [HttpGet]
         public IActionResult GetPeerInfo()

src/Blockcore/Controllers/DashboardController.cs

@@ -1,11 +1,13 @@
 using Blockcore.AsyncWork;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Blockcore.Controllers
 {
     /// <summary>
     /// Controller providing HTML Dashboard
     /// </summary>
+    [Authorize]
     [ApiController]
     [ApiVersion("1")]
     [Route("api/[controller]")]

src/Blockcore/Controllers/NetworkController.cs

@@ -8,6 +8,7 @@
 using Blockcore.P2P.Peer;
 using Blockcore.Utilities.Extensions;
 using Blockcore.Utilities.JsonErrors;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Logging;
 using NBitcoin;
@@ -17,6 +18,7 @@ namespace Blockcore.Controllers
     /// <summary>
     /// Provides methods that interact with the network elements of the full node.
     /// </summary>
+    [Authorize]
     [ApiController]
     [ApiVersion("1")]
     [Route("api/[controller]")]

src/Blockcore/Controllers/NodeController.cs

@@ -17,6 +17,7 @@
 using Blockcore.Utilities;
 using Blockcore.Utilities.JsonErrors;
 using Blockcore.Utilities.ModelStateErrors;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Logging;
 using NBitcoin;
@@ -33,6 +34,7 @@ namespace Blockcore.Controllers
     /// <summary>
     /// Provides methods that interact with the full node.
     /// </summary>
+    [Authorize]
     [ApiController]
     [ApiVersion("1")]
     [Route("api/[controller]")]
@@ -439,6 +441,7 @@ public async Task<IActionResult> GetTxOutAsync([FromQuery] string trxid, uint vo
         /// <seealso cref="https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Simple_requests"/>
         /// </remarks>
         /// <returns><see cref="OkResult"/></returns>
+        [Authorize(Policy = "OnlyAdmins")]
         [HttpPost]
         [Route("shutdown")]
         [Route("stop")]
@@ -456,6 +459,7 @@ public IActionResult Shutdown([FromBody] bool corsProtection = true)
         /// </summary>
         /// <param name="request">The request containing the loggers to modify.</param>
         /// <returns><see cref="OkResult"/></returns>
+        [Authorize(Policy = "OnlyAdmins")]
         [HttpPut]
         [Route("loglevels")]
         public IActionResult UpdateLogLevel([FromBody] LogRulesRequest request)

src/Features/Blockcore.Features.BlockStore/Api/Controllers/BlockStoreController.cs

@@ -9,6 +9,7 @@
 using Blockcore.Utilities;
 using Blockcore.Utilities.JsonErrors;
 using Blockcore.Utilities.ModelStateErrors;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Logging;
 using NBitcoin;
@@ -17,6 +18,7 @@ namespace Blockcore.Features.BlockStore.Api.Contollers
 {
 
     /// <summary>Controller providing operations on a blockstore.</summary>
+    [Authorize]
     [ApiController]
     [ApiVersion("1")]
     [Route("api/[controller]")]

src/Features/Blockcore.Features.ColdStaking/Api/Controllers/ColdStakingController.cs

@@ -7,6 +7,7 @@
 using Blockcore.Utilities;
 using Blockcore.Utilities.JsonErrors;
 using Blockcore.Utilities.ModelStateErrors;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Logging;
 using NBitcoin;
@@ -16,6 +17,7 @@ namespace Blockcore.Features.ColdStaking.Api.Controllers
     /// <summary>
     /// Controller providing operations for cold staking.
     /// </summary>
+    [Authorize]
     [ApiController]
     [ApiVersion("1")]
     [Route("api/[controller]")]

src/Features/Blockcore.Features.Consensus/ConsensusController.cs

@@ -8,6 +8,7 @@
 using Blockcore.Controllers;
 using Blockcore.Utilities;
 using Blockcore.Utilities.JsonErrors;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Logging;
 using NBitcoin;
@@ -17,6 +18,7 @@ namespace Blockcore.Features.Consensus
     /// <summary>
     /// A <see cref="FeatureController"/> that provides API and RPC methods from the consensus loop.
     /// </summary>
+    [Authorize]
     [ApiController]
     [ApiVersion("1")]
     [Route("api/[controller]")]

src/Features/Blockcore.Features.Diagnostic/Controllers/DiagnosticController.cs

@@ -10,13 +10,15 @@
 using Blockcore.Features.Diagnostic.Utils;
 using Blockcore.P2P.Peer;
 using Blockcore.Utilities.JsonErrors;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Blockcore.Features.Diagnostic.Controllers
 {
     /// <summary>
     /// Controller providing diagnostic operations on fullnode.
     /// </summary>
+    [Authorize]
     [ApiController]
     [ApiVersion("1")]
     [Route("api/[controller]/[action]")]

src/Features/Blockcore.Features.MemoryPool/MempoolController.cs

@@ -5,6 +5,7 @@
 using Blockcore.Controllers;
 using Blockcore.Utilities;
 using Blockcore.Utilities.JsonErrors;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Logging;
 using NBitcoin;
@@ -14,6 +15,7 @@ namespace Blockcore.Features.MemoryPool
     /// <summary>
     /// Controller providing operations on the Mempool.
     /// </summary>
+    [Authorize]
     [ApiVersion("1")]
     public class MempoolController : FeatureController
     {
@@ -42,6 +44,7 @@ public Task<List<uint256>> GetRawMempool()
         /// 
         /// </summary>
         /// <returns>Json formatted <see cref="List{T}<see cref="uint256"/>"/> containing the memory pool contents. Returns <see cref="IActionResult"/> formatted error if fails.</returns>
+        [AllowAnonymous]
         [Route("api/[controller]/getrawmempool")]
         [HttpGet]
         public async Task<IActionResult> GetRawMempoolAsync()

src/Features/Blockcore.Features.Miner/Api/Controllers/MiningController.cs

@@ -10,6 +10,7 @@
 using Blockcore.Features.Wallet.Types;
 using Blockcore.Utilities;
 using Blockcore.Utilities.JsonErrors;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Logging;
 using NBitcoin;
@@ -20,6 +21,7 @@ namespace Blockcore.Features.Miner.Api.Controllers
     /// <summary>
     /// API controller for calls related to PoW mining and PoS minting.
     /// </summary>
+    [Authorize]
     [ApiController]
     [ApiVersion("1")]
     [Route("api/[controller]")]