client-exec CLI

internal/server/server.go

@@ -35,6 +35,7 @@ type Server struct {
 	terminals *terminal.Terminals
 	tailnet   *local.Client
 	hostname  string
+	token     string
 	startedAt time.Time
 
 	usersMu sync.Mutex
@@ -43,7 +44,7 @@ type Server struct {
 
 type ctxKey struct{}
 
-func New(dataDir string, portFirst int, ts *tsnet.Server) (*Server, error) {
+func New(dataDir string, portFirst int, ts *tsnet.Server, token string) (*Server, error) {
 	err := os.MkdirAll(dataDir, 0o700)
 	if err != nil {
 		return nil, err
@@ -62,6 +63,7 @@ func New(dataDir string, portFirst int, ts *tsnet.Server) (*Server, error) {
 		hub:       newHub(),
 		tailnet:   lc,
 		hostname:  ts.Hostname,
+		token:     token,
 		startedAt: time.Now().UTC(),
 		users:     map[string]string{},
 	}
@@ -130,11 +132,12 @@ func (s *Server) Handler() http.Handler {
 	return http.NewCrossOriginProtection().Handler(mux)
 }
 
-func (s *Server) LoopbackHandler(token string) http.Handler {
+func (s *Server) LoopbackHandler() http.Handler {
 	mux := http.NewServeMux()
 	mux.HandleFunc("GET /api/tailnet", s.GetTailnet)
+	mux.HandleFunc("POST /api/clients/exec", s.ExecClient)
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if subtle.ConstantTimeCompare([]byte(r.Header.Get("Authorization")), []byte("Bearer "+token)) != 1 {
+		if !s.bearer(r) {
 			http.Error(w, "unauthorized", http.StatusUnauthorized)
 			return
 		}
@@ -143,6 +146,10 @@ func (s *Server) LoopbackHandler(token string) http.Handler {
 	})
 }
 
+func (s *Server) bearer(r *http.Request) bool {
+	return subtle.ConstantTimeCompare([]byte(r.Header.Get("Authorization")), []byte("Bearer "+s.token)) == 1
+}
+
 func (s *Server) GetTailnet(w http.ResponseWriter, r *http.Request) {
 	st, err := s.tailnet.StatusWithoutPeers(r.Context())
 	if err != nil {