add header auth (#52)

Author: botsman

.vscode/launch.json

@@ -16,7 +16,12 @@
             "type": "go",
             "request": "launch",
             "mode": "debug",
-            "program": "server/run.go"
+            "program": "server/run.go",
+            "env": {
+                "DATABASE_URL": "mongodb://localhost:27017/tppVerifier",
+                "AUTH_HEADER_NAME": "X-RapidAPI-Proxy-Secret",
+                "AUTH_HEADER_VALUE": "secret"
+            }
         },
         {
             "name": "Launch Package",

app/run.go

@@ -2,6 +2,7 @@ package app
 
 import (
 	"net/http"
+	"os"
 
 	"github.com/gin-gonic/gin"
 
@@ -14,6 +15,20 @@ type HttpClient interface {
 
 func SetupRouter(vs *verify.VerifySvc) *gin.Engine {
 	r := gin.Default()
+	headerName := os.Getenv("AUTH_HEADER_NAME")
+	headerValue := os.Getenv("AUTH_HEADER_VALUE")
+	if headerName == "" || headerValue == "" {
+		panic("AUTH_HEADER_NAME and AUTH_HEADER_VALUE must be set")
+	}
+
+	r.Use(func(c *gin.Context) {
+		if c.GetHeader(headerName) != headerValue {
+			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "Invalid or missing header"})
+			return
+		}
+		c.Next()
+	})
+
 	r.POST("/tpp/verify", vs.Verify)
 	r.GET("/health", func(c *gin.Context) {
 		c.JSON(http.StatusOK, gin.H{"status": "ok"})