Add authentication tokens to environment setup and apply middleware for API routes

README.md

@@ -53,6 +53,7 @@ In order to use this project, you will need:
 4. Configure the automation with the following settings:
    - Automation Type: `REST API`
    - URL: `http://your-computer-ip:3001/api/data`
+   - Headers: `api-key` `sk-xxx` (write token in `.env`)
    - Data Type: `Health Metrics` or `Workouts` (create separate automations for each if you want to sync different data types)
    - Export Format: `JSON`
    - Aggregate Data: `Enabled` 🟢

create-env.sh

@@ -8,6 +8,11 @@ DATABASE="health-auto-export"
 ENVIRONMENT="production"
 PORT="27017"
 
+
+# Generate random tokens for authentication
+READ_TOKEN=sk-$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | head -c 32)
+WRITE_TOKEN=sk-$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | head -c 32)
+
 echo "Creating .env file..."
 cat > .env << EOF
 NODE_ENV=${ENVIRONMENT}
@@ -16,6 +21,11 @@ MONGO_USERNAME=${USERNAME}
 MONGO_PASSWORD=${PASSWORD}
 MONGO_DB=${DATABASE}
 MONGO_PORT=${PORT}
+READ_TOKEN=${READ_TOKEN}
+WRITE_TOKEN=${WRITE_TOKEN}
 EOF
 
-echo "Environment configuration saved to .env file ✅"
+echo "Environment configuration saved to .env file ✅"
+echo "Generated READ_TOKEN: ${READ_TOKEN}"
+echo "Generated WRITE_TOKEN: ${WRITE_TOKEN}"
+echo "Store these tokens securely!"

docker-compose.yaml

@@ -42,6 +42,8 @@ services:
       - MONGO_DB=${MONGO_DB}
       - MONGO_USERNAME=${MONGO_USERNAME}
       - MONGO_PASSWORD=${MONGO_PASSWORD}
+      - READ_TOKEN=${READ_TOKEN}
+      - WRITE_TOKEN=${WRITE_TOKEN}
     depends_on:
       - hae-mongo
     networks:

server/src/app.ts

@@ -5,6 +5,7 @@ import mongodb from './database/mongodb';
 import ingesterRouter from './routes/ingester';
 import metricsRouter from './routes/metrics';
 import workoutsRouter from './routes/workouts';
+import { requireReadAuth, requireWriteAuth } from './middleware/auth';
 
 const app = express();
 const port = 3001;
@@ -22,9 +23,12 @@ app.use(cors(corsOptions));
 app.use(express.json({ limit: '200mb' }));
 app.use(express.urlencoded({ limit: '200mb', extended: true }));
 
-app.use('/api/data', ingesterRouter);
-app.use('/api/metrics', metricsRouter);
-app.use('/api/workouts', workoutsRouter);
+// Apply write auth middleware to data ingestion routes
+app.use('/api/data', requireWriteAuth, ingesterRouter);
+
+// Apply read auth middleware to data retrieval routes
+app.use('/api/metrics', requireReadAuth, metricsRouter);
+app.use('/api/workouts', requireReadAuth, workoutsRouter);
 
 app.get('/', (req: express.Request, res: express.Response) => {
   res.json({ message: 'Hello world!' });

server/src/middleware/auth.ts

@@ -0,0 +1,27 @@
+import { Request, Response, NextFunction } from 'express';
+
+/**
+ * Authentication middleware for read access
+ */
+export const requireReadAuth = (req: Request, res: Response, next: NextFunction) => {
+    const token = req.headers['api-key'] as string;
+
+    if (!token || !token.startsWith('sk-') || token !== process.env.READ_TOKEN) {
+        return res.status(401).json({ error: 'Unauthorized: Invalid read token' });
+    }
+
+    next();
+};
+
+/**
+ * Authentication middleware for write access
+ */
+export const requireWriteAuth = (req: Request, res: Response, next: NextFunction) => {
+    const token = req.headers['api-key'] as string;
+
+    if (!token || !token.startsWith('sk-') || token !== process.env.WRITE_TOKEN) {
+        return res.status(401).json({ error: 'Unauthorized: Invalid write token' });
+    }
+
+    next();
+};