#9 Major routes refactor and expansion, #15 Added API for statistics, Added search cache backend and functionality tests, Backend sync improvements

internal/server/token_handler.go

@@ -4,28 +4,30 @@ import (
 	"crypto/rand"
 	"encoding/base64"
 	"net/http"
+	"os"
 	"strings"
 	"time"
 
 	"music-server/internal/db/repository"
 	"music-server/internal/logging"
 
-	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/jackc/pgx/v5/pgtype"
+	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/labstack/echo/v5"
 	"go.uber.org/zap"
 )
 
 // TokenRequest represents a request to generate a new token
 type TokenRequest struct {
+	Password   string `json:"password"`    // Required: API password
 	ClientType string `json:"client_type"` // Optional: "web", "mobile", "api"
 }
 
 // TokenResponse represents the response with a new token
 type TokenResponse struct {
-	Token     string    `json:"token"`
-	ExpiresAt time.Time `json:"expires_at"`
-	ClientType string   `json:"client_type"`
+	Token      string    `json:"token"`
+	ExpiresAt  time.Time `json:"expires_at"`
+	ClientType string    `json:"client_type"`
 }
 
 // TokenHandler contains the database pool for token operations
@@ -53,13 +55,14 @@ func (h *TokenHandler) generateToken() (string, error) {
 // POST /api/v1/token
 //
 //	@Summary		Create session token
-//	@Description	Returns a new session token for API access
+//	@Description	Returns a new session token for API access. Requires valid API password.
 //	@Tags			auth
 //	@Accept		json
 //	@Produce		json
-//	@Param			request	body	TokenRequest	true	"Client type"
+//	@Param			request	body	TokenRequest	true	"Password and client type"
 //	@Success		200	{object}	TokenResponse
 //	@Failure		400	{object}	map[string]string
+//	@Failure		401	{object}	map[string]string
 //	@Failure		500	{object}	map[string]string
 //	@Router		/api/v1/token [post]
 func (h *TokenHandler) CreateTokenHandler(c *echo.Context) error {
@@ -68,6 +71,27 @@ func (h *TokenHandler) CreateTokenHandler(c *echo.Context) error {
 		return c.JSON(http.StatusBadRequest, map[string]string{"error": "Invalid request body"})
 	}
 
+	// Check if session auth is disabled
+	disableSessionAuth := os.Getenv("DISABLE_SESSION_AUTH") == "true"
+	apiPassword := os.Getenv("API_PASSWORD")
+
+	// Password validation logic:
+	// - If session auth is disabled, skip validation
+	// - If API_PASSWORD is empty, allow any password (open access mode)
+	// - If API_PASSWORD is set, require exact password match
+	if !disableSessionAuth {
+		if apiPassword != "" {
+			// API password is set - require exact match
+			if req.Password != apiPassword {
+				logging.GetLogger().Warn("Invalid password attempt for token creation",
+					zap.String("ip", c.RealIP()),
+					zap.String("user_agent", c.Request().UserAgent()))
+				return c.JSON(http.StatusUnauthorized, map[string]string{"error": "Invalid password"})
+			}
+		}
+		// If API_PASSWORD is empty, allow any password through (open access mode)
+	}
+
 	if req.ClientType == "" {
 		req.ClientType = "web"
 	}
@@ -98,8 +122,8 @@ func (h *TokenHandler) CreateTokenHandler(c *echo.Context) error {
 	}
 
 	response := TokenResponse{
-		Token:     session.Token,
-		ExpiresAt: session.ExpiresAt.Time,
+		Token:      session.Token,
+		ExpiresAt:  session.ExpiresAt.Time,
 		ClientType: *session.ClientType,
 	}