Add basic auth support

docs/reference/config.md

@@ -487,6 +487,18 @@ nav_order: 2
 |shutdownTimeout|The maximum amount of time to wait for any open HTTP requests to finish before shutting down the HTTP server|[`time.Duration`](https://pkg.go.dev/time#Duration)|`10s`
 |writeTimeout|The maximum time to wait when writing to an HTTP connection|[`time.Duration`](https://pkg.go.dev/time#Duration)|`15s`
 
+## http.auth
+
+|Key|Description|Type|Default Value|
+|---|-----------|----|-------------|
+|type|The auth plugin to use for server side authentication of requests|`string`|`<nil>`
+
+## http.auth.basic
+
+|Key|Description|Type|Default Value|
+|---|-----------|----|-------------|
+|passwordfile|The path to a .htpasswd file to use for authenticating requests. Passwords should be hashed with bcrypt.|`string`|`<nil>`
+
 ## http.tls
 
 |Key|Description|Type|Default Value|
@@ -564,6 +576,18 @@ nav_order: 2
 |shutdownTimeout|The maximum amount of time to wait for any open HTTP requests to finish before shutting down the HTTP server|[`time.Duration`](https://pkg.go.dev/time#Duration)|`10s`
 |writeTimeout|The maximum time to wait when writing to an HTTP connection|[`time.Duration`](https://pkg.go.dev/time#Duration)|`15s`
 
+## metrics.auth
+
+|Key|Description|Type|Default Value|
+|---|-----------|----|-------------|
+|type|The auth plugin to use for server side authentication of requests|`string`|`<nil>`
+
+## metrics.auth.basic
+
+|Key|Description|Type|Default Value|
+|---|-----------|----|-------------|
+|passwordfile|The path to a .htpasswd file to use for authenticating requests. Passwords should be hashed with bcrypt.|`string`|`<nil>`
+
 ## metrics.tls
 
 |Key|Description|Type|Default Value|
@@ -654,13 +678,27 @@ nav_order: 2
 
 |Key|Description|Type|Default Value|
 |---|-----------|----|-------------|
+|auth|Authorization plugin configuration|`map[string]string`|`<nil>`
 |blockchain|The list of configured Blockchain plugins|`string`|`<nil>`
 |database|The list of configured Database plugins|`string`|`<nil>`
 |dataexchange|The array of configured Data Exchange plugins |`string`|`<nil>`
 |identity|The list of available Identity plugins|`string`|`<nil>`
 |sharedstorage|The list of configured Shared Storage plugins|`string`|`<nil>`
 |tokens|The tokens plugin configurations. This will be used to configure tokens connectors|`string`|`<nil>`
 
+## plugins.auth[]
+
+|Key|Description|Type|Default Value|
+|---|-----------|----|-------------|
+|name|The name of the auth plugin to use|`string`|`<nil>`
+|type|The type of the auth plugin to use|`string`|`<nil>`
+
+## plugins.auth[].basic
+
+|Key|Description|Type|Default Value|
+|---|-----------|----|-------------|
+|passwordfile|The path to a .htpasswd file to use for authenticating requests. Passwords should be hashed with bcrypt.|`string`|`<nil>`
+
 ## plugins.blockchain[]
 
 |Key|Description|Type|Default Value|
@@ -1191,6 +1229,18 @@ nav_order: 2
 |shutdownTimeout|The maximum amount of time to wait for any open HTTP requests to finish before shutting down the HTTP server|[`time.Duration`](https://pkg.go.dev/time#Duration)|`10s`
 |writeTimeout|The maximum time to wait when writing to an HTTP connection|[`time.Duration`](https://pkg.go.dev/time#Duration)|`15s`
 
+## spi.auth
+
+|Key|Description|Type|Default Value|
+|---|-----------|----|-------------|
+|type|The auth plugin to use for server side authentication of requests|`string`|`<nil>`
+
+## spi.auth.basic
+
+|Key|Description|Type|Default Value|
+|---|-----------|----|-------------|
+|passwordfile|The path to a .htpasswd file to use for authenticating requests. Passwords should be hashed with bcrypt.|`string`|`<nil>`
+
 ## spi.tls
 
 |Key|Description|Type|Default Value|

go.mod

@@ -13,7 +13,7 @@ require (
 	github.com/golang-migrate/migrate/v4 v4.15.2
 	github.com/gorilla/mux v1.8.0
 	github.com/gorilla/websocket v1.5.0
-	github.com/hyperledger/firefly-common v0.1.13
+	github.com/hyperledger/firefly-common v0.1.14
 	github.com/hyperledger/firefly-signer v0.9.12
 	github.com/jarcoal/httpmock v1.1.0
 	github.com/karlseguin/ccache v2.0.3+incompatible

go.sum

@@ -726,8 +726,9 @@ github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/J
 github.com/hashicorp/serf v0.9.6/go.mod h1:TXZNMjZQijwlDvp+r0b63xZ45H7JmCmgg4gpTwn9UV4=
 github.com/hashicorp/serf v0.9.7/go.mod h1:TXZNMjZQijwlDvp+r0b63xZ45H7JmCmgg4gpTwn9UV4=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
-github.com/hyperledger/firefly-common v0.1.13 h1:eNK99U9FV43u1F46MM0mPuXT4Xn++orghpoTIIPsmwo=
 github.com/hyperledger/firefly-common v0.1.13/go.mod h1:2NqPi5Ud9H6rSlZXkLbotxW7z4EAD89p3/8oNOpm9Gs=
+github.com/hyperledger/firefly-common v0.1.14 h1:BFobO96kGPCC4UUvzdwdH8X5oXo1NbtqPrASrd9N0kY=
+github.com/hyperledger/firefly-common v0.1.14/go.mod h1:MNbaI2spBsdZYOub6Duj9xueE7Qyu9itOmJ4vE8tjYw=
 github.com/hyperledger/firefly-signer v0.9.12 h1:pCPiGHx1+MbTsIQuRkoQmfWxvpcvtGHVavls0NnH0po=
 github.com/hyperledger/firefly-signer v0.9.12/go.mod h1:GPQRUZOFOAjkLmg8GDjZUjEdUD0gcar+CSVhwltIwyw=
 github.com/iancoleman/strcase v0.2.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=

internal/apiserver/route_delete_contract_listener_test.go

@@ -28,6 +28,7 @@ import (
 
 func TestDeleteContractListenerByID(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	mcm := &contractmocks.Manager{}
 	o.On("Contracts").Return(mcm)
 	id := fftypes.NewUUID()

internal/apiserver/route_delete_subscription_test.go

@@ -31,6 +31,7 @@ import (
 
 func TestDeleteSubscription(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	input := core.Subscription{}
 	var buf bytes.Buffer
 	json.NewEncoder(&buf).Encode(&input)

internal/apiserver/route_get_batch_by_id_test.go

@@ -27,6 +27,7 @@ import (
 
 func TestGetBatchByID(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/mynamespace/batches/abcd12345", nil)
 	req.Header.Set("Content-Type", "application/json; charset=utf-8")
 	res := httptest.NewRecorder()

internal/apiserver/route_get_batches_test.go

@@ -27,6 +27,7 @@ import (
 
 func TestGetBatches(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/mynamespace/batches", nil)
 	req.Header.Set("Content-Type", "application/json; charset=utf-8")
 	res := httptest.NewRecorder()

internal/apiserver/route_get_blockchain_event_by_id_test.go

@@ -27,6 +27,7 @@ import (
 
 func TestGetBlockchainEventByID(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/mynamespace/blockchainevents/id12345", nil)
 	req.Header.Set("Content-Type", "application/json; charset=utf-8")
 	res := httptest.NewRecorder()

internal/apiserver/route_get_blockchain_events_test.go

@@ -27,6 +27,7 @@ import (
 
 func TestGetBlockchainEvents(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/mynamespace/blockchainevents", nil)
 	req.Header.Set("Content-Type", "application/json; charset=utf-8")
 	res := httptest.NewRecorder()

internal/apiserver/route_get_chart_histogram_test.go

@@ -28,7 +28,8 @@ import (
 )
 
 func TestGetChartHistogramBadStartTime(t *testing.T) {
-	_, r := newTestAPIServer()
+	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/mynamespace/charts/histogram/test?startTime=abc&endTime=456&buckets=30", nil)
 	req.Header.Set("Content-Type", "application/json; charset=utf-8")
 	res := httptest.NewRecorder()
@@ -39,7 +40,8 @@ func TestGetChartHistogramBadStartTime(t *testing.T) {
 }
 
 func TestGetChartHistogramBadEndTime(t *testing.T) {
-	_, r := newTestAPIServer()
+	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/mynamespace/charts/histogram/test?startTime=123&endTime=abc&buckets=30", nil)
 	req.Header.Set("Content-Type", "application/json; charset=utf-8")
 	res := httptest.NewRecorder()
@@ -50,7 +52,8 @@ func TestGetChartHistogramBadEndTime(t *testing.T) {
 }
 
 func TestGetChartHistogramBadBuckets(t *testing.T) {
-	_, r := newTestAPIServer()
+	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/mynamespace/charts/histogram/test?startTime=123&endTime=456&buckets=abc", nil)
 	req.Header.Set("Content-Type", "application/json; charset=utf-8")
 	res := httptest.NewRecorder()
@@ -62,6 +65,7 @@ func TestGetChartHistogramBadBuckets(t *testing.T) {
 
 func TestGetChartHistogramSuccess(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/mynamespace/charts/histogram/test?startTime=1234567890&endTime=1234567891&buckets=30", nil)
 	req.Header.Set("Content-Type", "application/json; charset=utf-8")
 	res := httptest.NewRecorder()

internal/apiserver/route_get_contract_api_by_name_test.go

@@ -30,6 +30,7 @@ import (
 
 func TestGetContractAPIByName(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	mcm := &contractmocks.Manager{}
 	o.On("Contracts").Return(mcm)
 	input := core.Datatype{}

internal/apiserver/route_get_contract_api_interface_test.go

@@ -31,6 +31,7 @@ import (
 
 func TestGetContractAPIInterface(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	mcm := &contractmocks.Manager{}
 	o.On("Contracts").Return(mcm)
 	input := core.Datatype{}

internal/apiserver/route_get_contract_api_listeners_test.go

@@ -30,6 +30,7 @@ import (
 
 func TestGetContractAPIListeners(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	mcm := &contractmocks.Manager{}
 	o.On("Contracts").Return(mcm)
 	input := core.Datatype{}

internal/apiserver/route_get_contract_apis_test.go

@@ -30,6 +30,7 @@ import (
 
 func TestGetContractAPIs(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	mcm := &contractmocks.Manager{}
 	o.On("Contracts").Return(mcm)
 	input := core.Datatype{}

internal/apiserver/route_get_contract_interface_name_version_test.go

@@ -31,6 +31,7 @@ import (
 
 func TestGetContractInterfaceNameVersion(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	mcm := &contractmocks.Manager{}
 	o.On("Contracts").Return(mcm)
 	input := core.Datatype{}
@@ -49,6 +50,7 @@ func TestGetContractInterfaceNameVersion(t *testing.T) {
 
 func TestGetContractInterfaceNameVersionWithChildren(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	mcm := &contractmocks.Manager{}
 	o.On("Contracts").Return(mcm)
 	input := core.Datatype{}

internal/apiserver/route_get_contract_interface_test.go

@@ -30,7 +30,8 @@ import (
 )
 
 func TestGetContractInterfaceBadID(t *testing.T) {
-	_, r := newTestAPIServer()
+	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	input := core.Datatype{}
 	var buf bytes.Buffer
 	json.NewEncoder(&buf).Encode(&input)
@@ -45,6 +46,7 @@ func TestGetContractInterfaceBadID(t *testing.T) {
 
 func TestGetContractInterface(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	mcm := &contractmocks.Manager{}
 	o.On("Contracts").Return(mcm)
 	input := core.Datatype{}
@@ -64,6 +66,7 @@ func TestGetContractInterface(t *testing.T) {
 
 func TestGetContractInterfaceWithChildren(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	mcm := &contractmocks.Manager{}
 	o.On("Contracts").Return(mcm)
 	input := core.Datatype{}

internal/apiserver/route_get_contract_interfaces_test.go

@@ -31,6 +31,7 @@ import (
 
 func TestGetContractInterfaces(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	mcm := &contractmocks.Manager{}
 	o.On("Contracts").Return(mcm)
 	input := core.Datatype{}

internal/apiserver/route_get_contract_listener_by_name_or_id_test.go

@@ -29,6 +29,7 @@ import (
 
 func TestGetContractListenerByNameOrID(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	mcm := &contractmocks.Manager{}
 	o.On("Contracts").Return(mcm)
 	id := fftypes.NewUUID()

internal/apiserver/route_get_contract_listener_test.go

@@ -28,6 +28,7 @@ import (
 
 func TestGetContractListener(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	mcm := &contractmocks.Manager{}
 	o.On("Contracts").Return(mcm)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/mynamespace/contracts/listeners", nil)

internal/apiserver/route_get_data_blob_test.go

@@ -32,6 +32,7 @@ import (
 
 func TestGetDataBlob(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	mdm := &datamocks.Manager{}
 	o.On("Data").Return(mdm)
 	o.On("MultiParty").Return(&multipartymocks.Manager{})

internal/apiserver/route_get_data_by_id_test.go

@@ -27,6 +27,7 @@ import (
 
 func TestGetDataByID(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/mynamespace/data/abcd12345", nil)
 	req.Header.Set("Content-Type", "application/json; charset=utf-8")
 	res := httptest.NewRecorder()

internal/apiserver/route_get_data_msgs_test.go

@@ -27,6 +27,7 @@ import (
 
 func TestGetMessagesForData(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/mynamespace/data/abcd1234/messages", nil)
 	req.Header.Set("Content-Type", "application/json; charset=utf-8")
 	res := httptest.NewRecorder()

internal/apiserver/route_get_data_test.go

@@ -27,6 +27,7 @@ import (
 
 func TestGetData(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/mynamespace/data", nil)
 	req.Header.Set("Content-Type", "application/json; charset=utf-8")
 	res := httptest.NewRecorder()

internal/apiserver/route_get_datatype_by_name_test.go

@@ -27,6 +27,7 @@ import (
 
 func TestGetDatatypeByName(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/mynamespace/datatypes/abcd/123", nil)
 	req.Header.Set("Content-Type", "application/json; charset=utf-8")
 	res := httptest.NewRecorder()

internal/apiserver/route_get_datatypes_test.go

@@ -27,6 +27,7 @@ import (
 
 func TestGetDatatypes(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/mynamespace/datatypes", nil)
 	req.Header.Set("Content-Type", "application/json; charset=utf-8")
 	res := httptest.NewRecorder()

internal/apiserver/route_get_event_by_id_test.go

@@ -27,6 +27,7 @@ import (
 
 func TestGetEventByID(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/mynamespace/events/abcd12345", nil)
 	req.Header.Set("Content-Type", "application/json; charset=utf-8")
 	res := httptest.NewRecorder()

internal/apiserver/route_get_events_test.go

@@ -29,6 +29,7 @@ import (
 
 func TestGetEvents(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/mynamespace/events", nil)
 	req.Header.Set("Content-Type", "application/json; charset=utf-8")
 	res := httptest.NewRecorder()
@@ -42,6 +43,7 @@ func TestGetEvents(t *testing.T) {
 
 func TestGetEventsWithReferences(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/mynamespace/events?fetchreferences", nil)
 	req.Header.Set("Content-Type", "application/json; charset=utf-8")
 	res := httptest.NewRecorder()

internal/apiserver/route_get_group_by_id_test.go

@@ -28,6 +28,7 @@ import (
 
 func TestGetGroupByHash(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/mynamespace/groups/abcd12345", nil)
 	req.Header.Set("Content-Type", "application/json; charset=utf-8")
 	res := httptest.NewRecorder()

internal/apiserver/route_get_groups_test.go

@@ -28,6 +28,7 @@ import (
 
 func TestGetGroups(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/mynamespace/groups", nil)
 	req.Header.Set("Content-Type", "application/json; charset=utf-8")
 	res := httptest.NewRecorder()

internal/apiserver/route_get_identities_test.go

@@ -28,6 +28,7 @@ import (
 
 func TestGetIdentities(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	mnm := &networkmapmocks.Manager{}
 	o.On("NetworkMap").Return(mnm)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/ns1/identities", nil)
@@ -42,6 +43,7 @@ func TestGetIdentities(t *testing.T) {
 
 func TestGetIdentitiesWithVerifiers(t *testing.T) {
 	o, r := newTestAPIServer()
+	o.On("Authorize", mock.Anything, mock.Anything).Return(nil)
 	mnm := &networkmapmocks.Manager{}
 	o.On("NetworkMap").Return(mnm)
 	req := httptest.NewRequest("GET", "/api/v1/namespaces/ns1/identities?fetchverifiers", nil)