feat: added auth by api key

furumi-web-player/src/web/auth.rs

@@ -5,6 +5,8 @@ use axum::{
     middleware::Next,
     response::{Html, IntoResponse, Redirect, Response},
 };
+
+const X_API_KEY: &str = "x-api-key";
 use openidconnect::{
     core::{CoreClient, CoreProviderMetadata, CoreResponseType},
     reqwest::async_http_client,
@@ -92,37 +94,51 @@ fn verify_sso_cookie(secret: &[u8], cookie_val: &str) -> Option<String> {
     }
 }
 
-/// Auth middleware: requires valid SSO session cookie.
+/// Auth middleware: requires valid SSO session cookie or x-api-key header.
 pub async fn require_auth(
     State(state): State<Arc<AppState>>,
     req: Request,
     next: Next,
 ) -> Response {
-    let oidc = match &state.oidc {
-        Some(o) => o,
-        None => return next.run(req).await, // No OIDC configured = no auth
-    };
-
-    let cookies = req
-        .headers()
-        .get(header::COOKIE)
-        .and_then(|v| v.to_str().ok())
-        .unwrap_or("");
-
-    for c in cookies.split(';') {
-        let c = c.trim();
-        if let Some(val) = c.strip_prefix(&format!("{}=", SESSION_COOKIE)) {
-            if verify_sso_cookie(&oidc.session_secret, val).is_some() {
+    // 1. Check x-api-key header (if configured)
+    if let Some(ref expected) = state.api_key {
+        if let Some(val) = req
+            .headers()
+            .get(X_API_KEY)
+            .and_then(|v| v.to_str().ok())
+        {
+            if val == expected {
                 return next.run(req).await;
             }
         }
     }
 
+    // 2. Check SSO session cookie (if OIDC configured)
+    if let Some(ref oidc) = state.oidc {
+        let cookies = req
+            .headers()
+            .get(header::COOKIE)
+            .and_then(|v| v.to_str().ok())
+            .unwrap_or("");
+
+        for c in cookies.split(';') {
+            let c = c.trim();
+            if let Some(val) = c.strip_prefix(&format!("{}=", SESSION_COOKIE)) {
+                if verify_sso_cookie(&oidc.session_secret, val).is_some() {
+                    return next.run(req).await;
+                }
+            }
+        }
+    }
+
     let uri = req.uri().to_string();
     if uri.starts_with("/api/") {
         (StatusCode::UNAUTHORIZED, "Unauthorized").into_response()
-    } else {
+    } else if state.oidc.is_some() {
         Redirect::to("/login").into_response()
+    } else {
+        // Only API key configured — no web login available
+        (StatusCode::UNAUTHORIZED, "Unauthorized").into_response()
     }
 }