Add API key authentication

pkg/horreum/configs.go

@@ -9,12 +9,14 @@ import (
 type HorreumCredentials struct {
 	Username *string
 	Password *string
+	ApiKey   *string
 }
 
 func NewDefaultHorreumCredentials() HorreumCredentials {
 	return HorreumCredentials{
 		Username: nil,
 		Password: nil,
+		ApiKey:   nil,
 	}
 }
 
@@ -25,6 +27,8 @@ const (
 	BEARER = iota
 	// BASIC encodes username and password in the HTTP request
 	BASIC
+	// API_KEY authenticate with Horreum tokens
+	API_KEY
 )
 
 type ClientConfiguration struct {

pkg/horreum/horreum.go

@@ -75,6 +75,13 @@ func NewHorreumClient(baseUrl string, credentials *HorreumCredentials, clientCon
 				log.Default().Println("Using Basic HTTP authentication")
 				client.AuthProvider = provider
 			}
+		} else if credentials.ApiKey != nil && (clientConfig == nil || clientConfig.AuthMethod == API_KEY) {
+			provider, err := authentication.NewApiKeyAuthenticationProvider(*credentials.ApiKey, "X-Horreum-API-Key", authentication.HEADER_KEYLOCATION)
+			if err != nil {
+				return nil, fmt.Errorf("error setting up auth provider: %w", err)
+			}
+			log.Default().Println("Using API key authentication")
+			client.AuthProvider = provider
 		} else if credentials.Password != nil {
 			return nil, fmt.Errorf("provided password without username")
 		}

pkg/horreum/horreum_integration_test.go

@@ -5,6 +5,7 @@ package horreum
 
 import (
 	"context"
+	"github.com/microsoft/kiota-abstractions-go/authentication"
 	"net/url"
 	"testing"
 
@@ -136,6 +137,39 @@ func TestAddAndDeleteTest(t *testing.T) {
 	a.EqualValues(0, *list.GetCount())
 }
 
+func TestAPIKeyAuthSetup(t *testing.T) {
+	client, _ := NewHorreumClient("http://localhost:8080", &HorreumCredentials{
+		Username: &username,
+		Password: &password,
+	}, &ClientConfiguration{
+		AuthMethod: BEARER,
+	})
+
+	keyRequest := api.NewUserApikeyPostRequestBody()
+	keyRequest.SetName(of("Go client test key"))
+	keyRequest.SetTypeEscaped(of(models.USER_KEYTYPE))
+
+	key, err := client.RawClient.Api().User().Apikey().Post(context.Background(), keyRequest, nil)
+	assert.Nil(t, err)
+	assert.NotEmpty(t, key)
+
+	apiClient, err := NewHorreumClient("http://localhost:8080", &HorreumCredentials{
+		ApiKey: key,
+	}, &ClientConfiguration{AuthMethod: API_KEY})
+
+	assert.IsType(t, &authentication.ApiKeyAuthenticationProvider{}, apiClient.AuthProvider)
+
+	// make sure the API Key header is added correctly to a dummy request
+	req := abstractions.NewRequestInformationWithMethodAndUrlTemplateAndPathParameters(abstractions.GET, "https://localhost:8080", make(map[string]string))
+	apiClient.AuthProvider.AuthenticateRequest(context.Background(), req, nil)
+	assert.True(t, req.Headers.ContainsKey("X-Horreum-API-Key"))
+	assert.Equal(t, *key, req.Headers.Get("X-Horreum-API-Key")[0])
+
+	// kiota go client requires https which prevents using the API Key for integration test (with a dev Horreum instance)
+	_, apiErr := apiClient.RawClient.Api().User().Apikey().Get(context.Background(), nil)
+	assert.NotNil(t, apiErr)
+}
+
 // of returns a pointer to the provided literal/const input
 func of[E any](e E) *E {
 	return &e