karti-ai
551739baa3
- Confirmed core bet via spike/mimecheck: mox/message parses a messy multipart message standalone (envelope, MIME tree, attachment, body) with only an io.ReaderAt — no mox store/config. Option B is viable. - cmd/openmail single binary: serve|migrate|smtpd|sender|version subcommands. - internal/api: chi router, constant-time bearer auth, /healthz, stubbed v0 AgentMail-shaped routes (501 until core services land). - internal/store: pgxpool + embedded, idempotent, tracked SQL migrations. - internal/store/migrations/0001_init.sql: full native schema (pods, inboxes, threads, messages, attachments, drafts, api_keys, webhooks, outbox, events, domains) with FTS + GIN indexes. Validated end-to-end against Postgres 16. - deploy/: docker-compose (postgres+minio+openmail+caddy), Caddyfile, DNS.md (MX/SPF/DKIM/DMARC/DANE/MTA-STS). Makefile, .gitignore. - Verified: go vet clean; build OK; health/auth smoke tests; migrate idempotent. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
31 lines
974 B
Go
31 lines
974 B
Go
package api
|
|
|
|
import (
|
|
"crypto/subtle"
|
|
"net/http"
|
|
"strings"
|
|
)
|
|
|
|
// bearerAuth is a bootstrap bearer-token gate against the configured admin
|
|
// token. Milestone 1+: replace with DB-backed api_keys lookup (hash compare,
|
|
// per-pod scoping). Until OPENMAIL_ADMIN_TOKEN is set, the API is closed.
|
|
func (s *Server) bearerAuth(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if s.cfg.AdminToken == "" {
|
|
writeJSON(w, http.StatusServiceUnavailable, map[string]string{
|
|
"error": "auth_unconfigured",
|
|
"message": "OPENMAIL_ADMIN_TOKEN not set; API is closed",
|
|
})
|
|
return
|
|
}
|
|
const prefix = "Bearer "
|
|
h := r.Header.Get("Authorization")
|
|
if !strings.HasPrefix(h, prefix) ||
|
|
subtle.ConstantTimeCompare([]byte(strings.TrimPrefix(h, prefix)), []byte(s.cfg.AdminToken)) != 1 {
|
|
writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "unauthorized"})
|
|
return
|
|
}
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|