Add a new OpenAPI v3 REST API to warewulfd at /api

Co-authored-by: jason yang <jasonyangshadow@gmail.com>

Signed-off-by: Jonathon Anderson <janderson@ciq.com>

internal/pkg/warewulfd/api/authentication.go

@@ -0,0 +1,56 @@
+package api
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+
+	"github.com/warewulf/warewulf/internal/pkg/config"
+	"github.com/warewulf/warewulf/internal/pkg/wwlog"
+)
+
+func AuthMiddleware(auth *config.Authentication, allowedNets []net.IPNet) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			wwlog.Debug("allowed subnets: %v", allowedNets)
+			wwlog.Debug("remote address: %v", r.RemoteAddr)
+			fromAllowedNet := false
+			if ipStr, _, err := net.SplitHostPort(r.RemoteAddr); err == nil {
+				ip := net.ParseIP(ipStr)
+				if ip == nil {
+					http.Error(w, fmt.Sprintf("Invalid remote address: %v", r.RemoteAddr), http.StatusForbidden)
+				}
+				for _, allowedNet := range allowedNets {
+					if allowedNet.Contains(ip) {
+						fromAllowedNet = true
+						break
+					}
+				}
+				if !fromAllowedNet {
+					http.Error(w, "Forbidden", http.StatusForbidden)
+					return
+				}
+			} else {
+				http.Error(w, fmt.Sprintf("Invalid remote address: %v", r.RemoteAddr), http.StatusForbidden)
+				return
+			}
+
+			if auth != nil {
+				username, password, ok := r.BasicAuth()
+				if !ok {
+					w.Header().Set("WWW-Authenticate", `Basic realm="Restricted"`)
+					http.Error(w, "Unauthorized", http.StatusUnauthorized)
+					return
+				}
+
+				_, err := auth.Authenticate(username, password)
+				if err != nil {
+					w.Header().Set("WWW-Authenticate", `Basic realm="Restricted"`)
+					http.Error(w, "Unauthorized", http.StatusUnauthorized)
+					return
+				}
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}