From 7f8b40616420fff26797ee45d41862c2b49422b8 Mon Sep 17 00:00:00 2001
From: Edward Shen <code@eddie.sh>
Date: Mon, 19 Jul 2021 00:10:13 -0400
Subject: [PATCH] Add support for skipping token validation

---
 src/main/kotlin/mdnet/server/ImageHandler.kt      | 2 +-
 src/main/kotlin/mdnet/server/ImageServer.kt       | 5 +++++
 src/main/kotlin/mdnet/server/TokenVerifier.kt     | 7 ++++++-
 src/main/kotlin/mdnet/settings/ClientSettings.kt  | 1 +
 src/test/kotlin/mdnet/server/TokenVerifierTest.kt | 2 +-
 5 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/src/main/kotlin/mdnet/server/ImageHandler.kt b/src/main/kotlin/mdnet/server/ImageHandler.kt
index de6a785..d164d7e 100644
--- a/src/main/kotlin/mdnet/server/ImageHandler.kt
+++ b/src/main/kotlin/mdnet/server/ImageHandler.kt
@@ -174,7 +174,7 @@ class ImageServer(
 
     companion object {
         private val LOGGER = LoggerFactory.getLogger(ImageServer::class.java)
-        private fun String.isImageMimetype() = this.toLowerCase().startsWith("image/")
+        private fun String.isImageMimetype() = this.lowercase().startsWith("image/")
 
         private fun baseHandler(): Filter =
             CachingFilters.Response.MaxAge(Clock.systemUTC(), Constants.MAX_AGE_CACHE)
diff --git a/src/main/kotlin/mdnet/server/ImageServer.kt b/src/main/kotlin/mdnet/server/ImageServer.kt
index 12532a8..b958191 100644
--- a/src/main/kotlin/mdnet/server/ImageServer.kt
+++ b/src/main/kotlin/mdnet/server/ImageServer.kt
@@ -108,8 +108,13 @@ fun getServer(
 
     val verifier = TokenVerifier(
         tokenKey = remoteSettings.tokenKey,
+        isDisabled = devSettings.disableTokenValidation,
     )
 
+    if (devSettings.disableTokenValidation) {
+        LOGGER.warn { "Token validation has been explicitly disabled. This should only be used for testing!" }
+    }
+
     return timeRequest()
         .then(addCommonHeaders(devSettings.sendServerHeader))
         .then(catchAllHideDetails())
diff --git a/src/main/kotlin/mdnet/server/TokenVerifier.kt b/src/main/kotlin/mdnet/server/TokenVerifier.kt
index 0083faf..2f411eb 100644
--- a/src/main/kotlin/mdnet/server/TokenVerifier.kt
+++ b/src/main/kotlin/mdnet/server/TokenVerifier.kt
@@ -37,11 +37,16 @@ import org.slf4j.LoggerFactory
 import java.time.OffsetDateTime
 import java.util.Base64
 
-class TokenVerifier(tokenKey: ByteArray) : Filter {
+class TokenVerifier(tokenKey: ByteArray, isDisabled: Boolean) : Filter {
     private val box = TweetNaclFast.SecretBox(tokenKey)
+    private val isDisabled = isDisabled
 
     override fun invoke(next: HttpHandler): HttpHandler {
         return then@{
+            if (isDisabled) {
+                return@then next(it)
+            }
+
             val chapterHash = Path.of("chapterHash")(it)
 
             val cleanedUri = it.uri.path.replaceBefore("/data", "/{token}")
diff --git a/src/main/kotlin/mdnet/settings/ClientSettings.kt b/src/main/kotlin/mdnet/settings/ClientSettings.kt
index d3fbbab..58234e6 100644
--- a/src/main/kotlin/mdnet/settings/ClientSettings.kt
+++ b/src/main/kotlin/mdnet/settings/ClientSettings.kt
@@ -50,6 +50,7 @@ data class DevSettings(
     val devUrl: String? = null,
     val disableSniCheck: Boolean = false,
     val sendServerHeader: Boolean = false,
+    val disableTokenValidation: Boolean = false,
 )
 
 @JsonNaming(PropertyNamingStrategies.SnakeCaseStrategy::class)
diff --git a/src/test/kotlin/mdnet/server/TokenVerifierTest.kt b/src/test/kotlin/mdnet/server/TokenVerifierTest.kt
index 8c81ec6..f80942a 100644
--- a/src/test/kotlin/mdnet/server/TokenVerifierTest.kt
+++ b/src/test/kotlin/mdnet/server/TokenVerifierTest.kt
@@ -31,7 +31,7 @@ class TokenVerifierTest : FreeSpec() {
         val clientKeys = TweetNaclFast.Box.keyPair()
         val box = TweetNaclFast.Box(clientKeys.publicKey, remoteKeys.secretKey)
 
-        val backend = TokenVerifier(box.before()).then {
+        val backend = TokenVerifier(box.before(), false).then {
             Response(Status.OK)
         }