feat: use session token for API auth

Signed-off-by: Aurora Gaffney <aurora@blinklabs.io>

Author: agaffney

cmd/vpn-indexer/main.go

@@ -157,6 +157,19 @@ func main() {
 	var crlInstance *crl.Crl
 	var wgClient *wireguard.Client
 	var s3Client *client.Client
+	var jwtIssuer *jwt.Issuer
+
+	// Initialize the JWT issuer up front: it signs browser session tokens for
+	// every protocol (so /api/auth/session is available regardless of protocol)
+	// and also authenticates the indexer to the WireGuard container. The key
+	// file config is shared (VPN_WG_JWT_KEY_FILE).
+	jwtIssuer, err = jwt.NewIssuer(cfg.Vpn.WGJWTKeyFile)
+	if err != nil {
+		slog.Error(
+			fmt.Sprintf("failed to initialize JWT issuer: %s", err),
+		)
+		os.Exit(1)
+	}
 
 	switch cfg.Vpn.Protocol {
 	case "openvpn":
@@ -181,15 +194,6 @@ func main() {
 		// Initialize WireGuard components if protocol is wireguard
 		slog.Info("initializing WireGuard components")
 
-		// Initialize JWT issuer for WG container authentication
-		jwtIssuer, err := jwt.NewIssuer(cfg.Vpn.WGJWTKeyFile)
-		if err != nil {
-			slog.Error(
-				fmt.Sprintf("failed to initialize JWT issuer: %s", err),
-			)
-			os.Exit(1)
-		}
-
 		// Initialize WG container client
 		wgClient = wireguard.NewClient(cfg.Vpn.WGContainerURL, jwtIssuer)
 
@@ -252,7 +256,7 @@ func main() {
 	}
 
 	// Start API listener
-	if err := api.Start(cfg, db, caInstance, wgClient, s3Client); err != nil {
+	if err := api.Start(cfg, db, caInstance, wgClient, s3Client, jwtIssuer); err != nil {
 		slog.Error(
 			"failed to start API:",
 			"error",

internal/api/api.go

@@ -25,6 +25,7 @@ import (
 	"github.com/blinklabs-io/vpn-indexer/internal/client"
 	"github.com/blinklabs-io/vpn-indexer/internal/config"
 	"github.com/blinklabs-io/vpn-indexer/internal/database"
+	"github.com/blinklabs-io/vpn-indexer/internal/jwt"
 	"github.com/blinklabs-io/vpn-indexer/internal/wireguard"
 	httpSwagger "github.com/swaggo/http-swagger"
 )
@@ -35,11 +36,12 @@ const (
 
 // Api holds the dependencies for the API server.
 type Api struct {
-	cfg      *config.Config
-	db       *database.Database
-	ca       *ca.Ca
-	wgClient *wireguard.Client
-	s3Client *client.Client
+	cfg       *config.Config
+	db        *database.Database
+	ca        *ca.Ca
+	wgClient  *wireguard.Client
+	s3Client  *client.Client
+	jwtIssuer *jwt.Issuer
 }
 
 // @title			vpn-indexer
@@ -58,16 +60,18 @@ func Start(
 	ca *ca.Ca,
 	wgClient *wireguard.Client,
 	s3Client *client.Client,
+	jwtIssuer *jwt.Issuer,
 ) error {
 	logger := slog.Default()
 	logger.Info("initializing API server")
 
 	api := &Api{
-		cfg:      cfg,
-		db:       db,
-		ca:       ca,
-		wgClient: wgClient,
-		s3Client: s3Client,
+		cfg:       cfg,
+		db:        db,
+		ca:        ca,
+		wgClient:  wgClient,
+		s3Client:  s3Client,
+		jwtIssuer: jwtIssuer,
 	}
 
 	//
@@ -91,6 +95,15 @@ func Start(
 	mainMux.HandleFunc("/api/tx/transfer", api.handleTxTransfer)
 	mainMux.HandleFunc("/api/tx/submit", api.handleTxSubmit)
 
+	// Session auth route (only register when a JWT issuer is available)
+	if api.jwtIssuer != nil {
+		mainMux.HandleFunc("/api/auth/session", api.handleAuthSession)
+	} else {
+		logger.Warn(
+			"session auth route not registered: jwtIssuer is nil",
+		)
+	}
+
 	// WireGuard API routes (only register when both wgClient and s3Client are available)
 	if api.wgClient != nil && api.s3Client != nil {
 		mainMux.HandleFunc("/api/client/wg-register", api.handleWGRegister)