From b2573a1ee38bd30cb7ce77eabe569ea9b50d1aa1 Mon Sep 17 00:00:00 2001 From: Pulse Monitor Date: Thu, 14 Aug 2025 12:18:36 +0000 Subject: [PATCH] fix: properly handle hashed API tokens in auth checks The export/import handlers were using direct string comparison for API tokens instead of proper hash comparison. This caused auth to fail when tokens were stored as hashes (which is what the security wizard does). addresses #314 --- internal/api/router.go | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/internal/api/router.go b/internal/api/router.go index fae383aa1..5c28d5542 100644 --- a/internal/api/router.go +++ b/internal/api/router.go @@ -352,7 +352,7 @@ echo "You will need to log in with your saved credentials." } else if isDocker { // For Docker, save credentials to persistent storage - // Docker containers need to persist auth config to /etc/pulse + // Docker containers need to persist auth config to /data envPath := filepath.Join(r.config.ConfigPath, ".env") envContent := fmt.Sprintf(`# Auto-generated by Pulse Quick Security Setup # Generated on %s @@ -552,7 +552,14 @@ ENABLE_AUDIT_LOG=true hasValidAPIToken := false if r.config.APIToken != "" { authHeader := req.Header.Get("X-API-Token") - hasValidAPIToken = (authHeader == r.config.APIToken) + // Check if stored token is hashed or plain text + if internalauth.IsAPITokenHashed(r.config.APIToken) { + // Compare against hash + hasValidAPIToken = internalauth.CompareAPIToken(authHeader, r.config.APIToken) + } else { + // Plain text comparison (legacy) + hasValidAPIToken = (authHeader == r.config.APIToken) + } } // If password auth is configured, session auth is sufficient @@ -625,7 +632,14 @@ ENABLE_AUDIT_LOG=true hasValidAPIToken := false if r.config.APIToken != "" { authHeader := req.Header.Get("X-API-Token") - hasValidAPIToken = (authHeader == r.config.APIToken) + // Check if stored token is hashed or plain text + if internalauth.IsAPITokenHashed(r.config.APIToken) { + // Compare against hash + hasValidAPIToken = internalauth.CompareAPIToken(authHeader, r.config.APIToken) + } else { + // Plain text comparison (legacy) + hasValidAPIToken = (authHeader == r.config.APIToken) + } } // If password auth is configured, session auth is sufficient