Merge pull request #12 from devtron-labs/authorizer-check-for-webhook

feat: Api token handling from header

Author: nishant-d

middleware/AuthMiddleware.go

@@ -25,21 +25,28 @@ import (
 	"strings"
 )
 
+const ApiTokenHeaderKey = "api-token"
+const tokenHeaderKey = "token"
+const argocdTokenHeaderKey = "argocd.token"
+
 // Authorizer is a middleware for authorization
 func Authorizer(sessionManager *SessionManager, whitelistChecker func(url string) bool) func(next http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		fn := func(w http.ResponseWriter, r *http.Request) {
-			cookie, _ := r.Cookie("argocd.token")
 			token := ""
-			if cookie != nil {
-				token = cookie.Value
-				r.Header.Set("token", token)
-			}
-			if token == "" && cookie == nil {
-				token = r.Header.Get("token")
-				//if cookie == nil && len(token) != 0 {
-				//	http.SetCookie(w, &http.Cookie{Name: "argocd.token", Value: token, Path: "/"})
-				//}
+			apiToken := r.Header.Get(ApiTokenHeaderKey)
+			if len(apiToken) > 0 {
+				// for external ci webhook request, will be authorize by api-token
+				token = apiToken
+			} else {
+				cookie, _ := r.Cookie(argocdTokenHeaderKey)
+				if cookie != nil {
+					token = cookie.Value
+					r.Header.Set(tokenHeaderKey, token)
+				}
+				if token == "" && cookie == nil {
+					token = r.Header.Get(tokenHeaderKey)
+				}
 			}
 			//users = append(users, "anonymous")
 			authEnabled := true
@@ -51,7 +58,9 @@ func Authorizer(sessionManager *SessionManager, whitelistChecker func(url string
 				_, err := sessionManager.VerifyToken(token)
 				if err != nil {
 					log.Printf("Error verifying token: %+v\n", err)
-					http.SetCookie(w, &http.Cookie{Name: "argocd.token", Value: token, Path: "/", MaxAge: -1})
+					if len(apiToken) == 0 {
+						http.SetCookie(w, &http.Cookie{Name: argocdTokenHeaderKey, Value: token, Path: "/", MaxAge: -1})
+					}
 					writeResponse(http.StatusUnauthorized, "Unauthorized", w, err)
 					return
 				}