Actually use the auth middleware for assets routes

2 files changed, 32 insertions, 0 deletions

diff --git a/srv/src/cmd/hash-password/main.go b/srv/src/cmd/hash-password/main.go
new file mode 100644
index 0000000..b787a4d
--- /dev/null
+++ b/srv/src/cmd/hash-password/main.go
@@ -0,0 +1,23 @@
+package main
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/mediocregopher/blog.mediocregopher.com/srv/api"
+)
+
+func main() {
+
+	fmt.Fprint(os.Stderr, "Password: ")
+
+	line, err := bufio.NewReader(os.Stdin).ReadString('\n')
+
+	if err != nil {
+		panic(err)
+	}
+
+	fmt.Println(api.NewPasswordHash(strings.TrimSpace(line)))
+}
diff --git a/srv/src/cmd/mediocre-blog/main.go b/srv/src/cmd/mediocre-blog/main.go
index 092c4da..5cb4d5f 100644
--- a/srv/src/cmd/mediocre-blog/main.go
+++ b/srv/src/cmd/mediocre-blog/main.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"os"
 	"os/signal"
 	"syscall"
@@ -55,6 +56,8 @@ func main() {
 
 	pathPrefix := cfg.String("path-prefix", "", "Prefix which is optionally applied to all URL paths rendered by the blog")
 
+	apiAuthUsersStr := cfg.String("api-auth-users", "{}", "JSON object with usernames as values and password hashes (produced by the hash-password binary) as values. Denotes users which are able to edit server-side data")
+
 	// initialization
 	err := cfg.Init(ctx)
 
@@ -128,6 +131,11 @@ func main() {
 	postStore := post.NewStore(postSQLDB)
 	postAssetStore := post.NewAssetStore(postSQLDB)
 
+	var apiAuthUsers map[string]string
+	if err := json.Unmarshal([]byte(*apiAuthUsersStr), &apiAuthUsers); err != nil {
+		logger.Fatal(ctx, "unmarshaling -api-auth-users", err)
+	}
+
 	apiParams.Logger = logger.WithNamespace("api")
 	apiParams.PowManager = powMgr
 	apiParams.PathPrefix = *pathPrefix
@@ -136,6 +144,7 @@ func main() {
 	apiParams.MailingList = ml
 	apiParams.GlobalRoom = chatGlobalRoom
 	apiParams.UserIDCalculator = chatUserIDCalc
+	apiParams.AuthUsers = apiAuthUsers
 
 	logger.Info(ctx, "listening")
 	a, err := api.New(apiParams)