feat(api): add API key authentication for task management and list tasks endpoint

Author: ksamirdev

README.md

@@ -1,5 +1,7 @@
 ### 🚀 Try Schedify: [schedify.dev](https://schedify.dev)
+
 No auth required. No infrastructure to manage. Just simple, reliable task scheduling for developers.
+
 - 📖 [Read our Dead Simple Integration Guide](https://schedify.dev/5-min-guide)
 - 🆓 [Start Scheduling - It's free](https://schedify.dev/schedules)
 
@@ -11,6 +13,36 @@ No auth required. No infrastructure to manage. Just simple, reliable task schedu
 
 Schedy lets you schedule HTTP POST requests to any endpoint at any time, with custom headers and payloads. Perfect for webhooks, bots, reminders, integrations, and all sorts of automation—without the bloat.
 
+## 🐳 Try Schedy in 1 Minute
+
+You can run Schedy instantly using Docker from either GitHub Container Registry or Docker Hub:
+
+**From GitHub Container Registry:**
+
+```sh
+docker run -p 8080:8080 ghcr.io/ksamirdev/schedy:latest
+```
+
+**From Docker Hub:**
+
+```sh
+docker run -p 8080:8080 ksamirdev/schedy:latest
+```
+
+You can also use a specific version tag (e.g., `v0.0.1`):
+
+```sh
+docker run -p 8080:8080 ghcr.io/ksamirdev/schedy:v0.0.1
+# or
+docker run -p 8080:8080 ksamirdev/schedy:v0.0.1
+```
+
+Set an API key for security (optional but recommended):
+
+```sh
+docker run -p 8080:8080 -e SCHEDY_API_KEY=your-secret ghcr.io/ksamirdev/schedy:latest
+```
+
 ---
 
 ## Features
@@ -33,22 +65,24 @@ Head to [Releases](https://github.com/ksamirdev/schedy/releases) and grab the la
 ### 2. Run
 
 ```bash
-./schedy --port 8081
+SCHEDY_API_KEY=your-secret ./schedy --port 8081
 ```
 
 Schedy will listen on the port you specify with `--port` (default: `8080`).
+If you set the `SCHEDY_API_KEY` environment variable, all API endpoints require the `X-API-Key` header.
 
 ---
 
 ## API
 
 ### Schedule a Task
 
-Send a POST to `/tasks`:
+Send a POST to `/tasks` (requires `X-API-Key` header if enabled):
 
 ```bash
 curl -X POST http://localhost:8080/tasks \
   -H "Content-Type: application/json" \
+  -H "X-API-Key: your-secret" \
   -d '{
     "execute_at": "2025-05-26T15:00:00Z",
     "url": "https://webhook.site/your-endpoint",
@@ -58,6 +92,7 @@ curl -X POST http://localhost:8080/tasks \
 ```
 
 #### Request Fields
+
 - `execute_at`: When to run (RFC3339, UTC)
 - `url`: Where to POST
 - `headers`: (optional) Map of HTTP headers
@@ -66,9 +101,11 @@ curl -X POST http://localhost:8080/tasks \
 #### Examples
 
 **JSON payload (default):**
+
 ```bash
 curl -X POST http://localhost:8080/tasks \
   -H "Content-Type: application/json" \
+  -H "X-API-Key: your-secret" \
   -d '{
     "execute_at": "2025-05-26T15:00:00Z",
     "url": "https://example.com/webhook",
@@ -77,9 +114,11 @@ curl -X POST http://localhost:8080/tasks \
 ```
 
 **Form data:**
+
 ```bash
 curl -X POST http://localhost:8080/tasks \
   -H "Content-Type: application/json" \
+  -H "X-API-Key: your-secret" \
   -d '{
     "execute_at": "2025-05-26T15:00:00Z",
     "url": "https://example.com/form",
@@ -89,9 +128,11 @@ curl -X POST http://localhost:8080/tasks \
 ```
 
 **Plain text:**
+
 ```bash
 curl -X POST http://localhost:8080/tasks \
   -H "Content-Type: application/json" \
+  -H "X-API-Key: your-secret" \
   -d '{
     "execute_at": "2025-05-26T15:00:00Z",
     "url": "https://example.com/text",
@@ -100,9 +141,21 @@ curl -X POST http://localhost:8080/tasks \
   }'
 ```
 
+### List Scheduled Tasks
+
+Send a GET to `/tasks/list` (requires `X-API-Key` header if enabled):
+
+```bash
+curl -X GET http://localhost:8080/tasks/list \
+  -H "X-API-Key: your-secret"
+```
+
+Returns a JSON array of all scheduled tasks.
+
 ---
 
 ## Why Schedy?
+
 - No cron, no YAML, no UI, no cloud lock-in
 - Just HTTP, just works
 - For hackers, tinkerers, and anyone who wants to automate the weird stuff

cmd/schedy/main.go

@@ -28,7 +28,8 @@ func main() {
 	handler := api.New(store)
 
 	mux := http.NewServeMux()
-	mux.HandleFunc("/tasks", handler.CreateTask)
+	mux.HandleFunc("POST /tasks", handler.WithAuth(handler.CreateTask))
+	mux.HandleFunc("GET /tasks", handler.WithAuth(handler.ListTasks))
 
 	addr := ":" + *port
 	srv := &http.Server{Addr: addr, Handler: mux}

internal/api/handler.go

@@ -3,18 +3,41 @@ package api
 import (
 	"encoding/json"
 	"net/http"
+	"os"
 	"time"
 
 	"github.com/google/uuid"
 	"github.com/ksamirdev/schedy/internal/scheduler"
 )
 
 type Handler struct {
-	Store scheduler.Store
+	Store  scheduler.Store
+	APIKey string
 }
 
 func New(store scheduler.Store) *Handler {
-	return &Handler{Store: store}
+	return &Handler{
+		Store:  store,
+		APIKey: os.Getenv("SCHEDY_API_KEY"),
+	}
+}
+
+// Middleware to check API key
+func (h *Handler) WithAuth(next http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if h.APIKey != "" {
+			key := r.Header.Get("X-API-Key")
+			if key == "" {
+				http.Error(w, "missing API key", http.StatusUnauthorized)
+				return
+			}
+			if key != h.APIKey {
+				http.Error(w, "invalid API key", http.StatusForbidden)
+				return
+			}
+		}
+		next(w, r)
+	}
 }
 
 func (h *Handler) CreateTask(w http.ResponseWriter, r *http.Request) {
@@ -55,3 +78,14 @@ func (h *Handler) CreateTask(w http.ResponseWriter, r *http.Request) {
 	w.WriteHeader(http.StatusCreated)
 	json.NewEncoder(w).Encode(task)
 }
+
+// ListTasks returns all scheduled tasks (no status yet)
+func (h *Handler) ListTasks(w http.ResponseWriter, r *http.Request) {
+	tasks, err := h.Store.ListTasks()
+	if err != nil {
+		http.Error(w, "could not list tasks", http.StatusInternalServerError)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(tasks)
+}

internal/scheduler/badger_store.go

@@ -75,3 +75,30 @@ func (s *BadgerStore) GetDueTasks(start, end time.Time) ([]Task, error) {
 	})
 	return tasks, err
 }
+
+func (s *BadgerStore) ListTasks() ([]Task, error) {
+	var tasks []Task
+
+	err := s.db.View(func(txn *badger.Txn) error {
+		it := txn.NewIterator(badger.DefaultIteratorOptions)
+		defer it.Close()
+
+		prefix := []byte("task:")
+		for it.Seek(prefix); it.ValidForPrefix(prefix); it.Next() {
+			item := it.Item()
+			err := item.Value(func(val []byte) error {
+				var t Task
+				if err := json.Unmarshal(val, &t); err == nil {
+					tasks = append(tasks, t)
+				}
+				return nil
+			})
+			if err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+
+	return tasks, err
+}

internal/scheduler/store.go

@@ -6,4 +6,5 @@ type Store interface {
 	Save(task Task) error
 	Delete(id string, timestamp int64) error
 	GetDueTasks(start, end time.Time) ([]Task, error)
+	ListTasks() ([]Task, error)
 }