add auth support

server/router/router.go

@@ -29,6 +29,14 @@ func New(logger *slog.Logger, database db.Database, buildTime string, sha1ver st
 	}
 
 	mux := http.NewServeMux()
+	requireAuth := middleware.RequireAuth(logger, settings)
+	withAuthRole := func(next http.HandlerFunc, roles ...string) http.Handler {
+		wrapped := http.Handler(http.HandlerFunc(next))
+		if len(roles) > 0 {
+			wrapped = middleware.RequireRole(roles...)(wrapped)
+		}
+		return requireAuth(wrapped)
+	}
 
 	reportsDir := settings.Values.Settings.ReportsDir
 	if reportsDir == "" {
@@ -44,37 +52,38 @@ func New(logger *slog.Logger, database db.Database, buildTime string, sha1ver st
 	mux.Handle("/favicon-32x32.png", middleware.CacheMiddleware(http.FileServer(http.FS(dist.AssetsDir))))
 	mux.Handle("/reports/", http.StripPrefix("/reports/", http.FileServer(http.Dir(filepath.Clean(reportsDir)))))
 	mux.HandleFunc("/", h.Home)
-	mux.HandleFunc("/api/event/vm/create", h.VmCreateEvent)
-	mux.HandleFunc("/api/event/vm/modify", h.VmModifyEvent)
-	mux.HandleFunc("/api/event/vm/move", h.VmMoveEvent)
-	mux.HandleFunc("/api/event/vm/delete", h.VmDeleteEvent)
-	mux.HandleFunc("/api/import/vm", h.VmImport)
+	mux.Handle("/api/event/vm/create", withAuthRole(h.VmCreateEvent, middleware.RoleAdmin))
+	mux.Handle("/api/event/vm/modify", withAuthRole(h.VmModifyEvent, middleware.RoleAdmin))
+	mux.Handle("/api/event/vm/move", withAuthRole(h.VmMoveEvent, middleware.RoleAdmin))
+	mux.Handle("/api/event/vm/delete", withAuthRole(h.VmDeleteEvent, middleware.RoleAdmin))
+	mux.Handle("/api/import/vm", withAuthRole(h.VmImport, middleware.RoleAdmin))
 	// Use this when we need to manually remove a VM from the database to clean up
-	mux.HandleFunc("/api/inventory/vm/delete", h.VmCleanup)
+	mux.Handle("/api/inventory/vm/delete", withAuthRole(h.VmCleanup, middleware.RoleAdmin))
 
 	// add missing data to VMs
-	mux.HandleFunc("/api/inventory/vm/update", h.VmUpdateDetails)
+	mux.Handle("/api/inventory/vm/update", withAuthRole(h.VmUpdateDetails, middleware.RoleAdmin))
 
 	// Legacy/maintenance endpoints are gated by settings.enable_legacy_api.
-	mux.HandleFunc("/api/cleanup/updates", h.UpdateCleanup)
+	mux.Handle("/api/cleanup/updates", withAuthRole(h.UpdateCleanup, middleware.RoleAdmin))
 	//mux.HandleFunc("/api/cleanup/vcenter", h.VcCleanup)
 
-	mux.HandleFunc("/api/report/inventory", h.InventoryReportDownload)
-	mux.HandleFunc("/api/report/updates", h.UpdateReportDownload)
-	mux.HandleFunc("/api/report/snapshot", h.SnapshotReportDownload)
-	mux.HandleFunc("/api/snapshots/aggregate", h.SnapshotAggregateForce)
-	mux.HandleFunc("/api/snapshots/hourly/force", h.SnapshotForceHourly)
-	mux.HandleFunc("/api/snapshots/migrate", h.SnapshotMigrate)
-	mux.HandleFunc("/api/snapshots/repair", h.SnapshotRepair)
-	mux.HandleFunc("/api/snapshots/repair/all", h.SnapshotRepairSuite)
-	mux.HandleFunc("/api/snapshots/regenerate-hourly-reports", h.SnapshotRegenerateHourlyReports)
-	mux.HandleFunc("/api/diagnostics/daily-creation", h.DailyCreationDiagnostics)
+	mux.Handle("/api/report/inventory", withAuthRole(h.InventoryReportDownload, middleware.RoleViewer))
+	mux.Handle("/api/report/updates", withAuthRole(h.UpdateReportDownload, middleware.RoleViewer))
+	mux.Handle("/api/report/snapshot", withAuthRole(h.SnapshotReportDownload, middleware.RoleViewer))
+	mux.Handle("/api/snapshots/aggregate", withAuthRole(h.SnapshotAggregateForce, middleware.RoleAdmin))
+	mux.Handle("/api/snapshots/hourly/force", withAuthRole(h.SnapshotForceHourly, middleware.RoleAdmin))
+	mux.Handle("/api/snapshots/migrate", withAuthRole(h.SnapshotMigrate, middleware.RoleAdmin))
+	mux.Handle("/api/snapshots/repair", withAuthRole(h.SnapshotRepair, middleware.RoleAdmin))
+	mux.Handle("/api/snapshots/repair/all", withAuthRole(h.SnapshotRepairSuite, middleware.RoleAdmin))
+	mux.Handle("/api/snapshots/regenerate-hourly-reports", withAuthRole(h.SnapshotRegenerateHourlyReports, middleware.RoleAdmin))
+	mux.Handle("/api/diagnostics/daily-creation", withAuthRole(h.DailyCreationDiagnostics, middleware.RoleViewer))
+	mux.HandleFunc("/api/auth/login", h.AuthLogin)
 	mux.HandleFunc("/vm/trace", h.VmTrace)
 	mux.HandleFunc("/vcenters", h.VcenterList)
 	mux.HandleFunc("/vcenters/totals", h.VcenterTotals)
 	mux.HandleFunc("/vcenters/totals/daily", h.VcenterTotalsDaily)
 	mux.HandleFunc("/vcenters/totals/hourly", h.VcenterTotalsHourlyDetailed)
-	mux.HandleFunc("/api/vcenters/cache/rebuild", h.VcenterCacheRebuild)
+	mux.Handle("/api/vcenters/cache/rebuild", withAuthRole(h.VcenterCacheRebuild, middleware.RoleAdmin))
 	mux.HandleFunc("/metrics", h.Metrics)
 
 	mux.HandleFunc("/snapshots/hourly", h.SnapshotHourlyList)
@@ -82,7 +91,7 @@ func New(logger *slog.Logger, database db.Database, buildTime string, sha1ver st
 	mux.HandleFunc("/snapshots/monthly", h.SnapshotMonthlyList)
 
 	// endpoint for encrypting vcenter credential
-	mux.HandleFunc("/api/encrypt", h.EncryptData)
+	mux.Handle("/api/encrypt", withAuthRole(h.EncryptData, middleware.RoleAdmin))
 
 	// serve swagger related components from the embedded fs
 	swaggerSub, err := fs.Sub(swaggerUI, "swagger-ui-dist")
@@ -100,12 +109,14 @@ func New(logger *slog.Logger, database db.Database, buildTime string, sha1ver st
 		w.Write(swaggerSpec)
 	})))
 
-	// Register pprof handlers
-	mux.HandleFunc("/debug/pprof/", pprof.Index)
-	mux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
-	mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
-	mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
-	mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
+	// Register pprof handlers only when enabled, and gate them behind admin auth.
+	if settings.Values.Settings.EnablePprof {
+		mux.Handle("/debug/pprof/", withAuthRole(pprof.Index, middleware.RoleAdmin))
+		mux.Handle("/debug/pprof/cmdline", withAuthRole(pprof.Cmdline, middleware.RoleAdmin))
+		mux.Handle("/debug/pprof/profile", withAuthRole(pprof.Profile, middleware.RoleAdmin))
+		mux.Handle("/debug/pprof/symbol", withAuthRole(pprof.Symbol, middleware.RoleAdmin))
+		mux.Handle("/debug/pprof/trace", withAuthRole(pprof.Trace, middleware.RoleAdmin))
+	}
 
 	return middleware.NewLoggingMiddleware(logger, mux)
 }