From 58bbdccee88978d49a98e8eda7985504b62082d8 Mon Sep 17 00:00:00 2001
From: Kalle <38327916+Sendouc@users.noreply.github.com>
Date: Sat, 13 Jan 2024 18:37:33 +0200
Subject: [PATCH] Add auth to public API

---
 app/features/api-public/api-public-utils.server.ts    | 11 +++++++++++
 .../api-public/routes/tournament-match.$id.ts         |  5 ++++-
 .../api-public/routes/tournament.$id.teams.ts         |  5 ++++-
 app/features/api-public/routes/tournament.$id.ts      |  5 ++++-
 app/features/api-public/routes/user.$identifier.ts    |  5 ++++-
 5 files changed, 27 insertions(+), 4 deletions(-)
 create mode 100644 app/features/api-public/api-public-utils.server.ts

diff --git a/app/features/api-public/api-public-utils.server.ts b/app/features/api-public/api-public-utils.server.ts
new file mode 100644
index 000000000..598355925
--- /dev/null
+++ b/app/features/api-public/api-public-utils.server.ts
@@ -0,0 +1,11 @@
+const apiTokens = process.env["PUBLIC_API_TOKENS"]?.split(",") ?? [];
+export function requireBearerAuth(req: Request) {
+  const authHeader = req.headers.get("Authorization");
+  if (!authHeader) {
+    throw new Response("Missing Authorization header", { status: 401 });
+  }
+  const token = authHeader.replace("Bearer ", "");
+  if (!apiTokens.includes(token)) {
+    throw new Response("Invalid token", { status: 401 });
+  }
+}
diff --git a/app/features/api-public/routes/tournament-match.$id.ts b/app/features/api-public/routes/tournament-match.$id.ts
index e534f7ef0..37453a7a4 100644
--- a/app/features/api-public/routes/tournament-match.$id.ts
+++ b/app/features/api-public/routes/tournament-match.$id.ts
@@ -7,12 +7,15 @@ import type { GetTournamentMatchResponse } from "../schema";
 import { i18next } from "~/modules/i18n";
 import { jsonArrayFrom } from "kysely/helpers/sqlite";
 import { resolveMapList } from "~/features/tournament-bracket/core/mapList.server";
+import { requireBearerAuth } from "../api-public-utils.server";
 
 const paramsSchema = z.object({
   id,
 });
 
-export const loader = async ({ params }: LoaderFunctionArgs) => {
+export const loader = async ({ params, request }: LoaderFunctionArgs) => {
+  requireBearerAuth(request);
+
   const t = await i18next.getFixedT("en", ["game-misc"]);
   const { id } = parseParams({
     params,
diff --git a/app/features/api-public/routes/tournament.$id.teams.ts b/app/features/api-public/routes/tournament.$id.teams.ts
index ee2248773..1dbe35e6e 100644
--- a/app/features/api-public/routes/tournament.$id.teams.ts
+++ b/app/features/api-public/routes/tournament.$id.teams.ts
@@ -7,12 +7,15 @@ import type { GetTournamentTeamsResponse } from "../schema";
 import { databaseTimestampToDate } from "~/utils/dates";
 import { jsonArrayFrom } from "kysely/helpers/sqlite";
 import { i18next } from "~/modules/i18n";
+import { requireBearerAuth } from "../api-public-utils.server";
 
 const paramsSchema = z.object({
   id,
 });
 
-export const loader = async ({ params }: LoaderFunctionArgs) => {
+export const loader = async ({ params, request }: LoaderFunctionArgs) => {
+  requireBearerAuth(request);
+
   const t = await i18next.getFixedT("en", ["game-misc"]);
   const { id } = parseParams({
     params,
diff --git a/app/features/api-public/routes/tournament.$id.ts b/app/features/api-public/routes/tournament.$id.ts
index b35138f45..817b8492a 100644
--- a/app/features/api-public/routes/tournament.$id.ts
+++ b/app/features/api-public/routes/tournament.$id.ts
@@ -7,12 +7,15 @@ import type { GetTournamentResponse } from "../schema";
 import { databaseTimestampToDate } from "~/utils/dates";
 import { HACKY_resolvePicture } from "~/features/tournament/tournament-utils";
 import { jsonArrayFrom } from "kysely/helpers/sqlite";
+import { requireBearerAuth } from "../api-public-utils.server";
 
 const paramsSchema = z.object({
   id,
 });
 
-export const loader = async ({ params }: LoaderFunctionArgs) => {
+export const loader = async ({ params, request }: LoaderFunctionArgs) => {
+  requireBearerAuth(request);
+
   const { id } = parseParams({ params, schema: paramsSchema });
 
   const tournament = notFoundIfFalsy(
diff --git a/app/features/api-public/routes/user.$identifier.ts b/app/features/api-public/routes/user.$identifier.ts
index 0dc79b088..e75430835 100644
--- a/app/features/api-public/routes/user.$identifier.ts
+++ b/app/features/api-public/routes/user.$identifier.ts
@@ -6,12 +6,15 @@ import { notFoundIfFalsy, parseParams } from "~/utils/remix";
 import type { GetUserResponse } from "../schema";
 import { jsonArrayFrom } from "kysely/helpers/sqlite";
 import { i18next } from "~/modules/i18n";
+import { requireBearerAuth } from "../api-public-utils.server";
 
 const paramsSchema = z.object({
   identifier: z.string(),
 });
 
-export const loader = async ({ params }: LoaderFunctionArgs) => {
+export const loader = async ({ params, request }: LoaderFunctionArgs) => {
+  requireBearerAuth(request);
+
   const t = await i18next.getFixedT("en", ["weapons"]);
   const { identifier } = parseParams({ params, schema: paramsSchema });