feat: whitelist version, add cli test

ipfs · Nov 15, 2023 · 7b97003 · 7b97003
1 parent 767dc37
commit 7b97003
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 1 deletion.
diff --git a/core/corehttp/commands.go b/core/corehttp/commands.go
@@ -210,6 +210,11 @@ func convertAuthorizationsMap(authScopes map[string]*config.RPCAuthScope) (map[s
 
 func withAuthSecrets(authorizations map[string]rpcAuthScopeWithUser, next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/api/v0/version" {
+			next.ServeHTTP(w, r)
+			return
+		}
+
 		authorizationHeader := r.Header.Get("Authorization")
 		auth, ok := authorizations[authorizationHeader]
 

diff --git a/test/cli/auth_test.go b/test/cli/auth_test.go
@@ -7,6 +7,7 @@ import (
 	"github.com/ipfs/kubo/config"
 	"github.com/ipfs/kubo/test/cli/harness"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestAuth(t *testing.T) {
@@ -26,7 +27,7 @@ func TestAuth(t *testing.T) {
 		return node
 	}
 
-	t.Run("Follows Allowed Paths", func(t *testing.T) {
+	t.Run("Follows Allowed Paths (HTTP)", func(t *testing.T) {
 		t.Parallel()
 
 		node := makeAndStartProtectedNode(t, map[string]*config.RPCAuthScope{
@@ -50,6 +51,27 @@ func TestAuth(t *testing.T) {
 		node.StopDaemon()
 	})
 
+	t.Run("Follows Allowed Paths (CLI)", func(t *testing.T) {
+		t.Parallel()
+
+		node := makeAndStartProtectedNode(t, map[string]*config.RPCAuthScope{
+			"userA": {
+				HTTPAuthSecret: "bearer:userAToken",
+				AllowedPaths:   []string{"/api/v0/id"},
+			},
+		})
+
+		// Can access ID.
+		resp := node.RunIPFS("id", "--api-secret", "Bearer userAToken")
+		require.NoError(t, resp.Err)
+
+		// But not Ping.
+		resp = node.RunIPFS("ping", "--api-secret", "Bearer userAToken")
+		require.Error(t, resp.Err)
+
+		node.StopDaemon()
+	})
+
 	t.Run("Generic Allowed Path Gives Full Access", func(t *testing.T) {
 		t.Parallel()