Authentication based on API key

Author: acoumb

src/Umbraco.Forms.Integrations.Automation.Zapier/Configuration/ZapierSettings.cs

@@ -11,9 +11,13 @@ public ZapierSettings()
 
         public ZapierSettings(NameValueCollection appSettings)
         {
-            UserGroup = appSettings[Constants.UmbracoFormsIntegrationsAutomationZapierUserGroup];
+            UserGroupAlias = appSettings[Constants.UmbracoFormsIntegrationsAutomationZapierUserGroupAlias];
+
+            ApiKey = appSettings[Constants.UmbracoFormsIntegrationsAutomationZapierApiKey];
         }
 
-        public string UserGroup { get; set; }
+        public string UserGroupAlias { get; set; }
+
+        public string ApiKey { get; set; }
     }
 }

src/Umbraco.Forms.Integrations.Automation.Zapier/Constants.cs

@@ -3,13 +3,17 @@ namespace Umbraco.Forms.Integrations.Automation.Zapier
 {
     public class Constants
     {
-        public const string UmbracoFormsIntegrationsAutomationZapierUserGroup = "Umbraco.Forms.Integrations.Automation.Zapier.UserGroup";
+        public const string UmbracoFormsIntegrationsAutomationZapierUserGroupAlias = "Umbraco.Forms.Integrations.Automation.Zapier.UserGroupAlias";
+
+        public const string UmbracoFormsIntegrationsAutomationZapierApiKey = "Umbraco.Forms.Integrations.Automation.Zapier.ApiKey";
 
         public static class ZapierAppConfiguration
         {
             public const string UsernameHeaderKey = "X-USERNAME";
 
             public const string PasswordHeaderKey = "X-PASSWORD";
+
+            public const string ApiKeyHeaderKey = "X-APIKEY";
         }
 
         public static class Configuration

src/Umbraco.Forms.Integrations.Automation.Zapier/Controllers/ZapierFormAuthorizedApiController.cs

@@ -40,6 +40,7 @@ public bool IsUserValid()
         {
             string username = string.Empty;
             string password = string.Empty;
+            string apiKey = string.Empty;
 
 #if NETCOREAPP
             if (Request.Headers.TryGetValue(Constants.ZapierAppConfiguration.UsernameHeaderKey,
@@ -48,18 +49,24 @@ public bool IsUserValid()
             if (Request.Headers.TryGetValue(Constants.ZapierAppConfiguration.PasswordHeaderKey,
                     out var passwordValues))
                 password = passwordValues.First();
+            if (Request.Headers.TryGetValue(Constants.ZapierAppConfiguration.ApiKeyHeaderKey,
+                    out var apiKeyValues))
+                apiKey = apiKeyValues.First();
 #else
             if (Request.Headers.TryGetValues(Constants.ZapierAppConfiguration.UsernameHeaderKey,
                     out var usernameValues))
                 username = usernameValues.First();
             if (Request.Headers.TryGetValues(Constants.ZapierAppConfiguration.PasswordHeaderKey,
                     out var passwordValues))
                 password = passwordValues.First();
+            if (Request.Headers.TryGetValues(Constants.ZapierAppConfiguration.ApiKeyHeaderKey,
+                    out var apiKeyValues))
+                apiKey = apiKeyValues.First();
 #endif
 
-            if (string.IsNullOrEmpty(username) || string.IsNullOrEmpty(password)) return false;
+            if (string.IsNullOrEmpty(apiKey) && (string.IsNullOrEmpty(username) || string.IsNullOrEmpty(password))) return false;
 
-            var isAuthorized = _userValidationService.Validate(username, password, Options.UserGroup).GetAwaiter()
+            var isAuthorized = _userValidationService.Validate(username, password, Options.ApiKey).GetAwaiter()
                 .GetResult();
             if (!isAuthorized) return false;
 

src/Umbraco.Forms.Integrations.Automation.Zapier/Services/IUserValidationService.cs

@@ -4,6 +4,6 @@ namespace Umbraco.Forms.Integrations.Automation.Zapier.Services
 {
     public interface IUserValidationService
     {
-        Task<bool> Validate(string username, string password, string userGroup);
+        Task<bool> Validate(string username, string password, string apiKey);
     }
 }

src/Umbraco.Forms.Integrations.Automation.Zapier/Services/UserValidationService.cs

@@ -1,10 +1,15 @@
 using System.Linq;
 using System.Threading.Tasks;
 
+using Umbraco.Forms.Integrations.Automation.Zapier.Configuration;
+
 #if NETCOREAPP
+using Microsoft.Extensions.Options;
+
 using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Services;
 #else
+using System.Configuration;
 using Umbraco.Core.Services;
 #endif
 
@@ -14,23 +19,31 @@ public class UserValidationService : IUserValidationService
     {
         private readonly IUserService _userService;
 
+        private readonly ZapierSettings _zapierSettings;
 
 #if NETCOREAPP
         private readonly IBackOfficeUserManager _backOfficeUserManager;
 
-        public UserValidationService(IBackOfficeUserManager backOfficeUserManager, IUserService userService)
+        public UserValidationService(IOptions<ZapierSettings> options, IBackOfficeUserManager backOfficeUserManager, IUserService userService)
         {
             _backOfficeUserManager = backOfficeUserManager;
+
+            _zapierSettings = options.Value;
         }
 #else
         public UserValidationService(IUserService userService)
         {
             _userService = userService;
+
+            _zapierSettings = new ZapierSettings(ConfigurationManager.AppSettings);
         }
 #endif
 
-        public async Task<bool> Validate(string username, string password, string userGroup)
+        public async Task<bool> Validate(string username, string password, string apiKey)
         {
+            if (!string.IsNullOrEmpty(apiKey))
+                return apiKey == _zapierSettings.ApiKey;
+
 #if NETCOREAPP
             var isUserValid =
                 await _backOfficeUserManager.ValidateCredentialsAsync(username, password);
@@ -40,11 +53,11 @@ public async Task<bool> Validate(string username, string password, string userGr
 
             if (!isUserValid) return false;
 
-            if (!string.IsNullOrEmpty(userGroup))
+            if (!string.IsNullOrEmpty(_zapierSettings.UserGroupAlias))
             {
                 var user = _userService.GetByUsername(username);
 
-                return user != null && user.Groups.Any(p => p.Name == userGroup);
+                return user != null && user.Groups.Any(p => p.Alias == _zapierSettings.UserGroupAlias);
             }
 
             return true;