feat(auth): implement complete API-key authentication with modular architecture (#47)
- Add comprehensive API-key authentication system with X-API-Key header validation - Implement permission-based access control (mail:send, * for admin) - Add rate-limiting system (60 req/hour per API key, 100 req/hour per IP) - Refactor monolithic 590-line main.lua into 6 modular components (<200 lines each) - Add IP-restriction support with CIDR notation (127.0.0.1, 10.0.0.0/8) - Implement Hugo integration with CORS support for localhost:1313 - Add production-ready configuration with environment variable support - Create comprehensive testing suite (auth, rate-limiting, stress tests) - Add production deployment checklist and cleanup scripts This refactoring transforms the API gateway from a single-file monolith into a biocodie-compliant modular architecture while adding enterprise-grade security features. Performance testing shows 79 RPS concurrent throughput with <100ms latency. Hugo contact form integration tested and working. System is now production-ready for deployment to walter/aitvaras. Resolves #47
This commit is contained in:
parent
445e751c16
commit
901f5eb2d8
14 changed files with 1160 additions and 80 deletions
|
|
@ -5,6 +5,11 @@
|
|||
local socket = require("socket")
|
||||
local cjson = require("cjson")
|
||||
|
||||
-- Load modules
|
||||
local Auth = require("src.auth")
|
||||
local MailRoute = require("src.routes.mail")
|
||||
local AuthRoute = require("src.routes.auth")
|
||||
|
||||
-- Load configuration
|
||||
local config = require("config.server")
|
||||
|
||||
|
|
@ -31,6 +36,11 @@ function FurtServer:add_route(method, path, handler)
|
|||
self.routes[method][path] = handler
|
||||
end
|
||||
|
||||
-- Add protected route (requires authentication)
|
||||
function FurtServer:add_protected_route(method, path, required_permission, handler)
|
||||
self:add_route(method, path, Auth.create_protected_route(required_permission, handler))
|
||||
end
|
||||
|
||||
-- Parse HTTP request
|
||||
function FurtServer:parse_request(client)
|
||||
local request_line = client:receive()
|
||||
|
|
@ -129,7 +139,7 @@ function FurtServer:create_response(status, data, content_type, additional_heade
|
|||
headers["Content-Type"] = content_type
|
||||
headers["Content-Length"] = tostring(#body)
|
||||
headers["Connection"] = "close"
|
||||
headers["Server"] = "Furt-Lua/1.0"
|
||||
headers["Server"] = "Furt-Lua/1.1"
|
||||
|
||||
-- Add additional headers if provided
|
||||
if additional_headers then
|
||||
|
|
@ -156,8 +166,11 @@ function FurtServer:get_status_text(status)
|
|||
[200] = "OK",
|
||||
[204] = "No Content",
|
||||
[400] = "Bad Request",
|
||||
[401] = "Unauthorized",
|
||||
[403] = "Forbidden",
|
||||
[404] = "Not Found",
|
||||
[405] = "Method Not Allowed",
|
||||
[429] = "Too Many Requests",
|
||||
[500] = "Internal Server Error"
|
||||
}
|
||||
return status_texts[status] or "Unknown"
|
||||
|
|
@ -189,7 +202,7 @@ function FurtServer:handle_client(client)
|
|||
end
|
||||
|
||||
if handler then
|
||||
local success, result = pcall(handler, request)
|
||||
local success, result = pcall(handler, request, self)
|
||||
if success then
|
||||
client:send(result)
|
||||
else
|
||||
|
|
@ -212,7 +225,9 @@ function FurtServer:start()
|
|||
end
|
||||
|
||||
print(string.format("Furt HTTP-Server started on %s:%d", self.host, self.port))
|
||||
print("CORS enabled for all origins")
|
||||
print("API-Key authentication: ENABLED")
|
||||
print("Rate limiting: ENABLED (60 req/hour per API key, 100 req/hour per IP)")
|
||||
print("CORS enabled for configured origins")
|
||||
print("Press Ctrl+C to stop")
|
||||
|
||||
while true do
|
||||
|
|
@ -225,89 +240,48 @@ function FurtServer:start()
|
|||
end
|
||||
end
|
||||
|
||||
-- Initialize server and routes
|
||||
-- Initialize server and register routes
|
||||
local server = FurtServer:new()
|
||||
|
||||
-- Health check route
|
||||
server:add_route("GET", "/health", function(request)
|
||||
-- Public routes (no authentication required)
|
||||
server:add_route("GET", "/health", function(request, server)
|
||||
local response_data = {
|
||||
status = "healthy",
|
||||
service = "furt-lua",
|
||||
version = "1.0.0",
|
||||
version = "1.1.0",
|
||||
timestamp = os.time(),
|
||||
smtp_configured = config.mail and config.mail.username ~= nil
|
||||
features = {
|
||||
smtp_configured = config.mail and config.mail.username ~= nil,
|
||||
auth_enabled = true,
|
||||
rate_limiting = true
|
||||
}
|
||||
}
|
||||
return server:create_response(200, response_data, nil, nil, request)
|
||||
end)
|
||||
|
||||
-- Test route for development
|
||||
server:add_route("POST", "/test", function(request)
|
||||
local response_data = {
|
||||
message = "Test endpoint working",
|
||||
received_data = request.body,
|
||||
headers_count = 0
|
||||
}
|
||||
|
||||
-- Count headers
|
||||
for _ in pairs(request.headers) do
|
||||
response_data.headers_count = response_data.headers_count + 1
|
||||
end
|
||||
|
||||
return server:create_response(200, response_data, nil, nil, request)
|
||||
end)
|
||||
-- Test endpoint for development (disable in production)
|
||||
if os.getenv("ENABLE_TEST_ENDPOINT") == "true" then
|
||||
server:add_route("POST", "/test", function(request, server)
|
||||
local response_data = {
|
||||
message = "Test endpoint working",
|
||||
received_data = request.body,
|
||||
headers_count = 0,
|
||||
warning = "This is a development endpoint"
|
||||
}
|
||||
|
||||
-- Count headers
|
||||
for _ in pairs(request.headers) do
|
||||
response_data.headers_count = response_data.headers_count + 1
|
||||
end
|
||||
|
||||
return server:create_response(200, response_data, nil, nil, request)
|
||||
end)
|
||||
print("⚠️ Test endpoint enabled (development mode)")
|
||||
end
|
||||
|
||||
-- Mail service route (placeholder for Week 1)
|
||||
server:add_route("POST", "/v1/mail/send", function(request)
|
||||
print("Mail endpoint called - Method: " .. request.method .. ", Path: " .. request.path)
|
||||
|
||||
-- Basic validation
|
||||
if not request.body or request.body == "" then
|
||||
return server:create_response(400, {error = "No request body"}, nil, nil, request)
|
||||
end
|
||||
|
||||
-- Try to parse JSON
|
||||
local success, data = pcall(cjson.decode, request.body)
|
||||
if not success then
|
||||
return server:create_response(400, {error = "Invalid JSON", body = request.body}, nil, nil, request)
|
||||
end
|
||||
|
||||
-- Basic field validation
|
||||
if not data.name or not data.email or not data.message then
|
||||
return server:create_response(400, {
|
||||
error = "Missing required fields",
|
||||
required = {"name", "email", "message"},
|
||||
received = data
|
||||
}, nil, nil, request)
|
||||
end
|
||||
|
||||
-- Send email via SMTP
|
||||
local SMTP = require("src.smtp")
|
||||
local smtp_client = SMTP:new(config.mail)
|
||||
|
||||
local request_id = os.time() .. "-" .. math.random(1000, 9999)
|
||||
local subject = data.subject or "Contact Form Message"
|
||||
local email_content = string.format("From: %s <%s>\nSubject: %s\n\n%s",
|
||||
data.name, data.email, subject, data.message)
|
||||
|
||||
local success, result = smtp_client:send_email(
|
||||
config.mail.to_address, subject, email_content, data.name)
|
||||
|
||||
if success then
|
||||
return server:create_response(200, {
|
||||
success = true,
|
||||
message = "Mail sent successfully",
|
||||
request_id = request_id
|
||||
}, nil, nil, request)
|
||||
else
|
||||
print("SMTP Error: " .. tostring(result))
|
||||
return server:create_response(500, {
|
||||
success = false,
|
||||
error = "Failed to send email: " .. tostring(result),
|
||||
request_id = request_id
|
||||
}, nil, nil, request)
|
||||
end
|
||||
|
||||
end)
|
||||
-- Protected routes (require authentication)
|
||||
server:add_protected_route("POST", "/v1/mail/send", "mail:send", MailRoute.handle_mail_send)
|
||||
server:add_protected_route("GET", "/v1/auth/status", nil, AuthRoute.handle_auth_status)
|
||||
|
||||
-- Start server
|
||||
server:start()
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue