implement basic authentication

ndscheduler/default_settings.py

@@ -92,5 +92,12 @@
 logging.getLogger().setLevel(logging.INFO)
 
 
+# To enable basic authentication, define the 'user' and 'pass'
+BASIC_AUTH_CONFIG = {
+    'user': '',
+    'pass': '',
+    'realm': 'Nextdoor Scheduler'
+}
+
 # Packages that contains job classes, e.g., simple_scheduler.jobs
 JOB_CLASS_PACKAGES = []

ndscheduler/server/server.py

@@ -5,6 +5,7 @@
     SchedulerServer.run()
 """
 
+import base64
 import logging
 import signal
 import sys
@@ -21,6 +22,36 @@
 logger = logging.getLogger(__name__)
 
 
+def require_basic_auth(handler_class, config=None):
+    config = config or dict()
+    config.setdefault('user', '')
+    config.setdefault('pass', '')
+    config.setdefault('realm', 'Next Scheduler')
+
+    if config['user'] and config['pass']:
+        def wrap_execute(handler_execute):
+            def check_auth(handler):
+                auth_header = handler.request.headers.get('Authorization')
+                if auth_header and auth_header.startswith('Basic '):
+                    auth_decoded = base64.decodestring(auth_header[6:])
+                    if '%s:%s' % (config['user'], config['pass']) == auth_decoded:
+                        return True
+                handler.set_status(401)
+                handler.set_header('WWW-Authenticate', 'Basic realm=%s' % config['realm'])
+                handler._transforms = []
+                handler.finish()
+                return False
+
+            def _execute(self, transforms, *args, **kwargs):
+                if not check_auth(self):
+                    return False
+                return handler_execute(self, transforms, *args, **kwargs)
+            return _execute
+
+        handler_class._execute = wrap_execute(handler_class._execute)
+    return handler_class
+
+
 class SchedulerServer:
 
     VERSION = 'v1'
@@ -41,7 +72,7 @@ def __init__(self, scheduler_instance):
         # Setup server
         URLS = [
             # Index page
-            (r'/', index.Handler),
+            (r'/', require_basic_auth(index.Handler, settings.BASIC_AUTH_CONFIG)),
 
             # APIs
             (r'/api/%s/jobs' % self.VERSION, jobs.Handler),