feat(security): add api token authentication configuration

commit: 57beb4af5129fd89d92c533c43eadd71c1a7ade6
author: bamen · 13mo ago · 2025-09-16 08:13 UTC
parent: d923696
signature: unsigned

2 files · +16 -0

M internal/config/config.go +12 -0


@@ -35,6 +35,7 @@ type Config struct {
35	35		CodecPreferences CodecConfig `mapstructure:"codec_preferences" yaml:"codec_preferences"`
36	36		WebkitMemory WebkitMemoryConfig `mapstructure:"webkit_memory" yaml:"webkit_memory"`
37	37		Debug DebugConfig `mapstructure:"debug" yaml:"debug"`
	38	+	APISecurity APISecurityConfig `mapstructure:"api_security" yaml:"api_security"`
38	39		// RenderingMode controls GPU/CPU rendering selection for WebKit
39	40		RenderingMode RenderingMode `mapstructure:"rendering_mode" yaml:"rendering_mode"`
40	41		}

@@ -208,6 +209,14 @@ type DebugConfig struct {
208	209		EnableGeneralDebug bool `mapstructure:"enable_general_debug" yaml:"enable_general_debug"`
209	210		}
210	211
	212	+	// APISecurityConfig holds optional API key protection for dumb://api endpoints
	213	+	type APISecurityConfig struct {
	214	+	// If non-empty, token that requests must present via `token` query param
	215	+	Token string `mapstructure:"token" yaml:"token"`
	216	+	// If true, require token for all API endpoints (except a minimal allowlist)
	217	+	RequireToken bool `mapstructure:"require_token" yaml:"require_token"`
	218	+	}
	219	+
211	220		// Manager handles configuration loading, watching, and reloading.
212	221		type Manager struct {
213	222		config *Config

@@ -264,6 +273,9 @@ func NewManager() (*Manager, error) {
264	273		"logging.max_backups": "LOGGING_MAX_BACKUPS",
265	274		"logging.max_age": "LOGGING_MAX_AGE",
266	275		"logging.compress": "LOGGING_COMPRESS",
	276	+	// API security
	277	+	"api_security.token": "API_TOKEN",
	278	+	"api_security.require_token": "API_REQUIRE_TOKEN",
267	279		}
268	280
269	281		for key, env := range bindings {


@@ -35,6 +35,7 @@ type Config struct {
35	CodecPreferences CodecConfig `mapstructure:"codec_preferences" yaml:"codec_preferences"`	35		CodecPreferences CodecConfig `mapstructure:"codec_preferences" yaml:"codec_preferences"`
36	WebkitMemory WebkitMemoryConfig `mapstructure:"webkit_memory" yaml:"webkit_memory"`	36		WebkitMemory WebkitMemoryConfig `mapstructure:"webkit_memory" yaml:"webkit_memory"`
37	Debug DebugConfig `mapstructure:"debug" yaml:"debug"`	37		Debug DebugConfig `mapstructure:"debug" yaml:"debug"`
		38	+	APISecurity APISecurityConfig `mapstructure:"api_security" yaml:"api_security"`
38	// RenderingMode controls GPU/CPU rendering selection for WebKit	39		// RenderingMode controls GPU/CPU rendering selection for WebKit
39	RenderingMode RenderingMode `mapstructure:"rendering_mode" yaml:"rendering_mode"`	40		RenderingMode RenderingMode `mapstructure:"rendering_mode" yaml:"rendering_mode"`
40	}	41		}

@@ -208,6 +209,14 @@ type DebugConfig struct {
208	EnableGeneralDebug bool `mapstructure:"enable_general_debug" yaml:"enable_general_debug"`	209		EnableGeneralDebug bool `mapstructure:"enable_general_debug" yaml:"enable_general_debug"`
209	}	210		}
210		211
		212	+	// APISecurityConfig holds optional API key protection for dumb://api endpoints
		213	+	type APISecurityConfig struct {
		214	+	// If non-empty, token that requests must present via `token` query param
		215	+	Token string `mapstructure:"token" yaml:"token"`
		216	+	// If true, require token for all API endpoints (except a minimal allowlist)
		217	+	RequireToken bool `mapstructure:"require_token" yaml:"require_token"`
		218	+	}
		219	+
211	// Manager handles configuration loading, watching, and reloading.	220		// Manager handles configuration loading, watching, and reloading.
212	type Manager struct {	221		type Manager struct {
213	config *Config	222		config *Config

@@ -264,6 +273,9 @@ func NewManager() (*Manager, error) {
264	"logging.max_backups": "LOGGING_MAX_BACKUPS",	273		"logging.max_backups": "LOGGING_MAX_BACKUPS",
265	"logging.max_age": "LOGGING_MAX_AGE",	274		"logging.max_age": "LOGGING_MAX_AGE",
266	"logging.compress": "LOGGING_COMPRESS",	275		"logging.compress": "LOGGING_COMPRESS",
		276	+	// API security
		277	+	"api_security.token": "API_TOKEN",
		278	+	"api_security.require_token": "API_REQUIRE_TOKEN",
267	}	279		}
268		280
269	for key, env := range bindings {	281		for key, env := range bindings {

M internal/config/defaults.go +4 -0


@@ -140,6 +140,10 @@ func DefaultConfig() *Config {
140	140		EnableScriptDebug: false,
141	141		EnableGeneralDebug: false,
142	142		},
	143	+	APISecurity: APISecurityConfig{
	144	+	Token: "",
	145	+	RequireToken: false,
	146	+	},
143	147		RenderingMode: RenderingModeAuto,
144	148		}
145	149		}


@@ -140,6 +140,10 @@ func DefaultConfig() *Config {
140	EnableScriptDebug: false,	140		EnableScriptDebug: false,
141	EnableGeneralDebug: false,	141		EnableGeneralDebug: false,
142	},	142		},
		143	+	APISecurity: APISecurityConfig{
		144	+	Token: "",
		145	+	RequireToken: false,
		146	+	},
143	RenderingMode: RenderingModeAuto,	147		RenderingMode: RenderingModeAuto,
144	}	148		}
145	}	149		}