feat: optional basic auth support

cmd/depviz/main.go

@@ -52,6 +52,8 @@ var (
 	serverWithPprof          = serverFlags.Bool("with-pprof", false, "enable pprof endpoints")
 	serverWithoutRecovery    = serverFlags.Bool("without-recovery", false, "disable panic recovery (dev)")
 	serverWithoutCache       = serverFlags.Bool("without-cache", false, "disable HTTP caching")
+	serverBasicAuth          = serverFlags.String("basic-auth", "", "basic auth password (user='depviz')")
+	serverRealm              = serverFlags.String("realm", "DepViz", "server Realm")
 
 	runFlags            = flag.NewFlagSet("run", flag.ExitOnError)
 	runNoPull           = runFlags.Bool("no-pull", false, "don't pull providers (graph only)")
@@ -293,6 +295,8 @@ func execServer(args []string) error {
 			WithPprof:          *serverWithPprof,
 			WithoutRecovery:    *serverWithoutRecovery,
 			WithoutCache:       *serverWithoutCache,
+			BasicAuth:          *serverBasicAuth,
+			Realm:              *serverRealm,
 			Godmode:            *serverGodmode,
 		}
 		svc, err = dvserver.New(ctx, store, schemaConfig, opts)

internal/dvserver/auth.go

@@ -0,0 +1,31 @@
+package dvserver
+
+import (
+	"fmt"
+	"net/http"
+)
+
+func basicAuth(basicAuth string, realm string) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			_, password, ok := r.BasicAuth()
+			if !ok {
+				unauthorized(w, realm)
+				return
+			}
+
+			if basicAuth == password {
+				next.ServeHTTP(w, r)
+				return
+			}
+
+			unauthorized(w, realm)
+		})
+	}
+}
+
+func unauthorized(w http.ResponseWriter, realm string) {
+	w.Header().Add("WWW-Authenticate", fmt.Sprintf(`Basic realm="%s"`, realm))
+	w.WriteHeader(http.StatusUnauthorized)
+	fmt.Fprintf(w, "invalid credentials\n")
+}

internal/dvserver/server.go

@@ -40,6 +40,8 @@ type Opts struct {
 	WithPprof          bool
 	Godmode            bool
 	WithoutCache       bool
+	BasicAuth          string
+	Realm              string
 }
 
 type Service interface {
@@ -76,6 +78,9 @@ func New(ctx context.Context, h *cayley.Handle, schema *schema.Config, opts Opts
 	if opts.CORSAllowedOrigins == "" {
 		opts.CORSAllowedOrigins = "*"
 	}
+	if opts.Realm == "" {
+		opts.Realm = "DepViz"
+	}
 
 	svc := service{
 		ctx:    ctx,
@@ -133,6 +138,9 @@ func New(ctx context.Context, h *cayley.Handle, schema *schema.Config, opts Opts
 
 	if opts.HTTPBind != "" {
 		r := chi.NewRouter()
+		if opts.BasicAuth != "" {
+			r.Use(basicAuth(opts.BasicAuth, opts.Realm))
+		}
 		cors := cors.New(cors.Options{
 			AllowedOrigins:   strings.Split(opts.CORSAllowedOrigins, ","),
 			AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},