fup: allow Fup-Token header for carrying auth credentials

web/fup/fuphttp/auth.go

@@ -8,6 +8,18 @@ import (
 	"github.com/gorilla/mux"
 )
 
+func tokenFromRequest(r *http.Request) (token string, ok bool) {
+	// Check for a Fup-Token header.
+	v := r.Header.Get("Fup-Token")
+	if v != "" {
+		return v, true
+	}
+
+	// Check for basic auth.
+	_, v, ok = r.BasicAuth()
+	return v, ok
+}
+
 func TokenAuthMiddleware(token, realm string) mux.MiddlewareFunc {
 	return func(next http.Handler) http.Handler {
 		if token == "" {
@@ -28,8 +40,7 @@ func TokenAuthMiddleware(token, realm string) mux.MiddlewareFunc {
 				http.Error(rw, s, http.StatusUnauthorized)
 			}
 
-			// Check for basic auth, first.
-			_, pw, ok := r.BasicAuth()
+			pw, ok := tokenFromRequest(r)
 			switch {
 			case !ok:
 				requestAuth("unparsable or no credentials")

web/fup/fuphttp/auth_test.go

@@ -27,7 +27,8 @@ func TestTokenAuthMiddleware(t *testing.T) {
 	tcs := []struct {
 		name        string
 		path        string
-		username, password string
+		password    string
+		headerToken string
 		wantStatus  int
 		wantText    string
 	}{{
@@ -46,6 +47,11 @@ func TestTokenAuthMiddleware(t *testing.T) {
 		path:       "/",
 		password:   "token",
 		wantStatus: http.StatusOK,
+	}, {
+		name:        "root, with good creds as header",
+		path:        "/",
+		headerToken: "token",
+		wantStatus:  http.StatusOK,
 	}, {
 		name:       "raw",
 		path:       "/raw/foo.txt",
@@ -89,6 +95,9 @@ func TestTokenAuthMiddleware(t *testing.T) {
 			if tc.password != "" {
 				req.SetBasicAuth("", tc.password)
 			}
+			if tc.headerToken != "" {
+				req.Header.Set("Fup-Token", tc.headerToken)
+			}
 
 			resp, err := s.Client().Do(req)
 			if err != nil {