Support bearer tokens for authentication

auth.go

 package main
 
 import (
+	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"flag"
 	"log"
 	"net/http"
 	"os"
+	"strings"
 
 	"git.autistici.org/ai3/go-common/pwhash"
 	"github.com/coreos/go-systemd/v22/daemon"
 )
 
 var (
-	passwordFile = flag.String("passwords", "/etc/nginx-authenticator/users.json", "JSON file with usernames/passwords")
+	passwordFile     = flag.String("passwords", "/etc/nginx-authenticator/users.json", "JSON file with usernames/passwords")
+	enableBasicAuth  = flag.Bool("enable-basic-auth", true, "enable Basic authentication")
+	enableBearerAuth = flag.Bool("enable-bearer-token-auth", true, "enable bearer token authentication")
 
 	passwords = make(map[string]string)
+	tokens    = make(map[string]string)
 )
 
 func authenticate(username, password string) bool {
@@ -29,22 +34,39 @@ func authenticate(username, password string) bool {
 func handleAuthenticate(w http.ResponseWriter, req *http.Request) {
 	status := http.StatusForbidden
 
-	if username, password, ok := req.BasicAuth(); ok {
-		if authenticate(username, password) {
-			status = http.StatusOK
-			log.Printf("auth(%s) -> ok", username)
-		} else {
-			log.Printf("auth(%s) -> ERROR", username)
+	if *enableBasicAuth {
+		if username, password, ok := req.BasicAuth(); ok {
+			if authenticate(username, password) {
+				status = http.StatusOK
+				log.Printf("auth(%s) -> ok", username)
+			} else {
+				log.Printf("auth(%s) -> ERROR", username)
+			}
+			goto done
 		}
 	}
 
+	if *enableBearerAuth {
+		if auth := req.Header.Get("Authorization"); strings.HasPrefix(auth, "Bearer ") {
+			key, _ := base64.StdEncoding.DecodeString(auth)
+			if username, ok := tokens[string(key)]; ok {
+				status = http.StatusOK
+				log.Printf("auth(%s) -> ok", username)
+			} else {
+				log.Printf("auth() -> ERROR")
+			}
+		}
+	}
+
+done:
 	w.WriteHeader(status)
 }
 
 func loadUsers(path string) error {
 	var users []struct {
-		Name     string `json:"name"`
-		Password string `json:"password"`
+		Name     string   `json:"name"`
+		Password string   `json:"password"`
+		Tokens   []string `json:"api_tokens"`
 	}
 	data, err := os.ReadFile(path)
 	if err != nil {
@@ -55,6 +77,9 @@ func loadUsers(path string) error {
 	}
 	for _, u := range users {
 		passwords[u.Name] = u.Password
+		for _, t := range u.Tokens {
+			tokens[t] = u.Name
+		}
 	}
 	return nil
 }