Revert "auth"

This reverts commit aa31cc37d9.

src/main/java/org/zaine/app/controller/AuthController.java

@@ -4,6 +4,7 @@ package org.zaine.app.controller;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import org.zaine.app.security.JwtUtil;
+import org.zaine.app.security.RequiresAuth;
 import org.zaine.app.user.User;
 import org.zaine.app.user.UserRepository;
 import org.springframework.http.*;
@@ -16,6 +17,7 @@ import java.util.Map;
 
 @RestController
 @RequestMapping("/api/auth")
+@RequiresAuth
 @Tag(name = "Authentication")
 public class AuthController {
 

src/main/java/org/zaine/app/controller/CommentsController.java

@@ -22,7 +22,6 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 
 @RestController
 @RequestMapping("/api/comments")
-@RequiresAuth
 @Tag(name = "Comments", description = "Endpoints for managing comments")
 public class CommentsController {
 
@@ -87,6 +86,7 @@ public class CommentsController {
 		value = "",
 		consumes = "application/json"
 	)
+	@RequiresAuth
 	public void addComment(@RequestBody CreateCommentDTO dto) {
 
 		if (dto.getContent() == null || dto.getContent().trim().isEmpty()) {

src/main/java/org/zaine/app/security/ApiKeyAuthService.java

@@ -0,0 +1,31 @@
+package org.zaine.app.security;
+
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+
+@Component
+public class ApiKeyAuthService {
+
+    private final String apiKey;
+
+    public ApiKeyAuthService(@Value("${org.auth.api-key:}") String apiKey) {
+        this.apiKey = apiKey == null ? "" : apiKey.trim();
+    }
+
+    public boolean isConfigured() {
+        return !apiKey.isBlank();
+    }
+
+    public boolean isValid(String candidate) {
+        if (!isConfigured() || candidate == null || candidate.isBlank()) {
+            return false;
+        }
+
+        byte[] expected = apiKey.getBytes(StandardCharsets.UTF_8);
+        byte[] provided = candidate.trim().getBytes(StandardCharsets.UTF_8);
+        return MessageDigest.isEqual(expected, provided);
+    }
+}

src/main/java/org/zaine/app/security/JwtAuthFilter.java

@@ -19,11 +19,14 @@ import java.util.List;
 @Component
 public class JwtAuthFilter extends OncePerRequestFilter {
 
-    private final JwtUtil jwtUtil;
+    public static final String API_KEY_HEADER = "X-Org-Api-Key";
+
+    private final ApiKeyAuthService apiKeyAuthService;
     private final RequestMappingHandlerMapping requestMappingHandlerMapping;
 
-    public JwtAuthFilter(JwtUtil jwtUtil, RequestMappingHandlerMapping requestMappingHandlerMapping) {
-        this.jwtUtil = jwtUtil;
+    public JwtAuthFilter(ApiKeyAuthService apiKeyAuthService,
+                         RequestMappingHandlerMapping requestMappingHandlerMapping) {
+        this.apiKeyAuthService = apiKeyAuthService;
         this.requestMappingHandlerMapping = requestMappingHandlerMapping;
     }
 
@@ -36,26 +39,17 @@ public class JwtAuthFilter extends OncePerRequestFilter {
             return;
         }
 
-        String authHeader = request.getHeader("Authorization");
-
-        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
-            response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Missing or invalid Authorization header");
+        String apiKey = request.getHeader(API_KEY_HEADER);
+        if (apiKeyAuthService.isValid(apiKey)) {
+            var auth = new UsernamePasswordAuthenticationToken("api-key", null, List.of());
+            auth.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
+            SecurityContextHolder.getContext().setAuthentication(auth);
+            filterChain.doFilter(request, response);
             return;
         }
 
-        String token = authHeader.substring(7);
-
-        if (!jwtUtil.isTokenValid(token)) {
-            response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Invalid or expired token");
-            return;
-        }
-
-        String username = jwtUtil.extractUsername(token);
-        var auth = new UsernamePasswordAuthenticationToken(username, null, List.of());
-        auth.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
-        SecurityContextHolder.getContext().setAuthentication(auth);
-
-        filterChain.doFilter(request, response);
+        response.sendError(HttpServletResponse.SC_UNAUTHORIZED,
+                "Missing or invalid " + API_KEY_HEADER + " header");
     }
 
     private boolean endpointRequiresAuth(HttpServletRequest request) {