Skip to content

Commit bfd2c76

Browse files
CodeShellDevCodeShellDev
authored
Merge pull request #17 from CodeShellDev/dev
Update Main
2 parents a842244 + c2f02d4 commit bfd2c76

File tree

9 files changed

+186
-112
lines changed

9 files changed

+186
-112
lines changed

‎.github/templates/README.template.md‎

Lines changed: 37 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -55,12 +55,12 @@ To use Basic Auth as Authorization Method add `Authorization: Basic BASE64_STRIN
5555

5656
User is `api` (LOWERCASE)
5757

58-
Formatting for `BASE64_STRING` = `user:API_KEY`.
58+
Formatting for `BASE64_STRING` = `user:API_TOKEN`.
5959

6060
example:
6161

6262
```bash
63-
echo "api:API_KEY" | base64
63+
echo "api:API_TOKEN" | base64
6464
```
6565

6666
=> `YXBpOkFQSV9LRVkK`
@@ -76,7 +76,7 @@ Here is a simple example:
7676
curl -X POST http://sec-signal-api:8880/v2/send?@authorization=API_TOKEN
7777
```
7878

79-
Notice the `@` infront of `authorization`. See [Formatting](#format)
79+
Notice the `@` infront of `authorization`. See [Formatting](#format).
8080

8181
### Example
8282

@@ -121,9 +121,17 @@ http://sec-signal-api:8880/v1/receive/{{.NUMBER}}
121121

122122
In some cases you may not be able to access / modify the Request Body, in that case specify needed values in the Request Query:
123123

124-
```
125-
http://sec-signal-api:8880/?@key=value
126-
```
124+
Supported types include **strings**, **ints** and **arrays**
125+
126+
`http://sec-signal-api:8880/?@key=value`
127+
128+
| type | example |
129+
| :--------- | :------ |
130+
| string | abc |
131+
| int | 123 |
132+
| array | [1,2,3] |
133+
| array(int) | 1,2,3 |
134+
| array(str) | a,b,c |
127135

128136
##### Format
129137

@@ -132,38 +140,42 @@ you have to add `@` in front of any KeyValue Pair assignment.
132140

133141
### Environment Variables
134142

135-
#### API Token
143+
#### API Token/s
144+
145+
Both `API_TOKEN` and `API_TOKENS` support multiple Tokens seperated by **,**.
146+
During Authentikcation Secured Signal API will try to match the given Token against the list of Tokens inside of these Variables.
147+
148+
```yaml
149+
environment:
150+
API_TOKEN: "token1, token2, token3"
151+
API_TOKENS: "token1, token2, token3"
152+
```
136153
137154
> [!IMPORTANT]
138155
> It is highly recommended to set this Environment Variable
139156
140157
> _What if I just don't?_
141158
142-
Well, Secured Signal API will still work, but important Security Features won't be available
159+
Secured Signal API will still work, but important Security Features won't be available
143160
like Blocked Endpoints and any sort of Auth.
144161
145162
> [!NOTE]
146163
> Blocked Endpoints can be reactivated by manually setting them in the Environment
147164
148165
#### Blocked Endpoints
149166
150-
Because Secured Signal API is just a secure Proxy you can use all of the [Signal REST API](https://github.com/bbernhard/signal-cli-rest-api/blob/master/doc/EXAMPLES.md) endpoints except for...
151-
152-
- **/v1/about**
153-
154-
- **/v1/configuration**
155-
156-
- **/v1/devices**
157-
158-
- **/v1/register**
159-
160-
- **/v1/unregister**
161-
162-
- **/v1/qrcodelink**
163-
164-
- **/v1/accounts**
165-
166-
- **/v1/contacts**
167+
Because Secured Signal API is just a Proxy you can use all of the [Signal REST API](https://github.com/bbernhard/signal-cli-rest-api/blob/master/doc/EXAMPLES.md) endpoints except for...
168+
169+
| Endpoint |
170+
| :-------------------- |
171+
| **/v1/about** |
172+
| **/v1/configuration** |
173+
| **/v1/devives** |
174+
| **/v1/register** |
175+
| **/v1/unregister** |
176+
| **/v1/qrcodelink** |
177+
| **/v1/accounts** |
178+
| **/v1/contacts** |
167179
168180
These Endpoints are blocked by default due to Security Risks, but can be modified by setting `BLOCKED_ENDPOINTS` to a valid json array string
169181

‎README.md‎

Lines changed: 37 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -114,12 +114,12 @@ To use Basic Auth as Authorization Method add `Authorization: Basic BASE64_STRIN
114114

115115
User is `api` (LOWERCASE)
116116

117-
Formatting for `BASE64_STRING` = `user:API_KEY`.
117+
Formatting for `BASE64_STRING` = `user:API_TOKEN`.
118118

119119
example:
120120

121121
```bash
122-
echo "api:API_KEY" | base64
122+
echo "api:API_TOKEN" | base64
123123
```
124124

125125
=> `YXBpOkFQSV9LRVkK`
@@ -135,7 +135,7 @@ Here is a simple example:
135135
curl -X POST http://sec-signal-api:8880/v2/send?@authorization=API_TOKEN
136136
```
137137

138-
Notice the `@` infront of `authorization`. See [Formatting](#format)
138+
Notice the `@` infront of `authorization`. See [Formatting](#format).
139139

140140
### Example
141141

@@ -180,9 +180,17 @@ http://sec-signal-api:8880/v1/receive/{{.NUMBER}}
180180
181181
In some cases you may not be able to access / modify the Request Body, in that case specify needed values in the Request Query:
182182
183-
```
184-
http://sec-signal-api:8880/?@key=value
185-
```
183+
Supported types include **strings**, **ints** and **arrays**
184+
185+
`http://sec-signal-api:8880/?@key=value`
186+
187+
| type | example |
188+
| :--------- | :------ |
189+
| string | abc |
190+
| int | 123 |
191+
| array | [1,2,3] |
192+
| array(int) | 1,2,3 |
193+
| array(str) | a,b,c |
186194
187195
##### Format
188196
@@ -191,38 +199,42 @@ you have to add `@` in front of any KeyValue Pair assignment.
191199
192200
### Environment Variables
193201
194-
#### API Token
202+
#### API Token/s
203+
204+
Both `API_TOKEN` and `API_TOKENS` support multiple Tokens seperated by **,**.
205+
During Authentikcation Secured Signal API will try to match the given Token against the list of Tokens inside of these Variables.
206+
207+
```yaml
208+
environment:
209+
API_TOKEN: "token1, token2, token3"
210+
API_TOKENS: "token1, token2, token3"
211+
```
195212

196213
> [!IMPORTANT]
197214
> It is highly recommended to set this Environment Variable
198215
199216
> _What if I just don't?_
200217
201-
Well, Secured Signal API will still work, but important Security Features won't be available
218+
Secured Signal API will still work, but important Security Features won't be available
202219
like Blocked Endpoints and any sort of Auth.
203220

204221
> [!NOTE]
205222
> Blocked Endpoints can be reactivated by manually setting them in the Environment
206223
207224
#### Blocked Endpoints
208225

209-
Because Secured Signal API is just a secure Proxy you can use all of the [Signal REST API](https://github.com/bbernhard/signal-cli-rest-api/blob/master/doc/EXAMPLES.md) endpoints except for...
210-
211-
- **/v1/about**
212-
213-
- **/v1/configuration**
214-
215-
- **/v1/devices**
216-
217-
- **/v1/register**
218-
219-
- **/v1/unregister**
220-
221-
- **/v1/qrcodelink**
222-
223-
- **/v1/accounts**
224-
225-
- **/v1/contacts**
226+
Because Secured Signal API is just a Proxy you can use all of the [Signal REST API](https://github.com/bbernhard/signal-cli-rest-api/blob/master/doc/EXAMPLES.md) endpoints except for...
227+
228+
| Endpoint |
229+
| :-------------------- |
230+
| **/v1/about** |
231+
| **/v1/configuration** |
232+
| **/v1/devives** |
233+
| **/v1/register** |
234+
| **/v1/unregister** |
235+
| **/v1/qrcodelink** |
236+
| **/v1/accounts** |
237+
| **/v1/contacts** |
226238

227239
These Endpoints are blocked by default due to Security Risks, but can be modified by setting `BLOCKED_ENDPOINTS` to a valid json array string
228240

‎go.mod‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
module github.com/codeshelldev/secured-signal-api
22

3-
go 1.24.4
3+
go 1.24.5
44

55
require go.uber.org/zap v1.27.0
66

7-
require go.uber.org/multierr v1.10.0 // indirect
7+
require go.uber.org/multierr v1.11.0 // indirect

‎go.sum‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,14 @@
1-
go.uber.org/multierr v1.10.0 h1:S0h4aNzvfcFsC3dRF1jLoaov7oRaKqRGC/pUEJ2yvPQ=
2-
go.uber.org/multierr v1.10.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
1+
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
2+
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
3+
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
4+
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
5+
github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
6+
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
7+
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
8+
go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
9+
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
10+
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
311
go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
412
go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
13+
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
14+
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

‎internals/proxy/middlewares/auth.go‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,15 @@ import (
44
"encoding/base64"
55
"net/http"
66
"net/url"
7+
"slices"
78
"strings"
89

910
log "github.com/codeshelldev/secured-signal-api/utils/logger"
1011
)
1112

1213
type AuthMiddleware struct {
1314
Next http.Handler
14-
Token string
15+
Tokens []string
1516
}
1617

1718
type authType string
@@ -34,12 +35,16 @@ func getAuthType(str string) authType {
3435
}
3536
}
3637

38+
func isValidToken(tokens []string, match string) (bool) {
39+
return slices.Contains(tokens, match)
40+
}
41+
3742
func (data AuthMiddleware) Use() http.Handler {
3843
next := data.Next
39-
token := data.Token
44+
tokens := data.Tokens
4045

4146
return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
42-
if token == "" {
47+
if len(tokens) <= 0 {
4348
next.ServeHTTP(w, req)
4449
return
4550
}
@@ -60,7 +65,7 @@ func (data AuthMiddleware) Use() http.Handler {
6065

6166
switch authType {
6267
case Bearer:
63-
if authToken == token {
68+
if isValidToken(tokens, authToken) {
6469
success = true
6570
}
6671

@@ -76,7 +81,7 @@ func (data AuthMiddleware) Use() http.Handler {
7681

7782
user := "api"
7883

79-
if basicAuthParams[0] == user && basicAuthParams[1] == token {
84+
if basicAuthParams[0] == user && isValidToken(tokens, basicAuthParams[1]) {
8085
success = true
8186
}
8287
}
@@ -86,7 +91,7 @@ func (data AuthMiddleware) Use() http.Handler {
8691

8792
authToken, _ := url.QueryUnescape(authQuery)
8893

89-
if authToken == token {
94+
if isValidToken(tokens, authToken) {
9095
success = true
9196

9297
modifiedQuery := req.URL.Query()

‎main.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,8 @@ func main() {
4242
}
4343

4444
auth_m1 := AuthMiddleware{
45-
Next: endp_m2.Use(),
46-
Token: ENV.API_TOKEN,
45+
Next: endp_m2.Use(),
46+
Tokens: ENV.API_TOKENS,
4747
}
4848

4949
log_m0 := LogMiddleware{

0 commit comments

Comments
 (0)