fix and example for the AUTH_METHOD=PROXY_HEADER

- deny unauthenticated user, in case the proxy has been skipped
- mini example with Caddy as proxy adding pseudo authenticated headers

docs/auth_examples/header-auth/Caddyfile

@@ -0,0 +1,17 @@
+{
+	http_port 8081
+	auto_https off
+	log {
+		format console
+	}
+	servers {
+		log_credentials
+	}
+}
+:8081 {
+	reverse_proxy otterwiki:80 {
+		header_up x-otterwiki-name "Otter Example"
+		header_up x-otterwiki-email "[email protected]"
+		header_up x-otterwiki-permissions "READ,WRITE,UPLOAD,ADMIN"
+	}
+}

docs/auth_examples/header-auth/Makefile

@@ -0,0 +1,5 @@
+run:
+	docker compose up --remove-orphans
+
+caddy-fmt
+	docker run -v $(PWD)/Caddyfile:/srv/Caddyfile:rw caddy:2 caddy fmt --overwrite Caddyfile

docs/auth_examples/header-auth/README.md

@@ -0,0 +1,18 @@
+# Example for testing `AUTH_METHOD=PROXY_HEADER`
+
+This is a minimal example for testing the `PROXY_HEADER` auth method.
+Here a Caddy sets the headers as if they were configured by an auth
+service.
+
+Usage:
+
+    make run
+
+Testing:
+
+- On <http://localhost:8080> the otterwiki is listening, no header is
+set. The access results in a 403 Forbidden
+- On <http://localhost:8081> a caddy server is listening, which does a
+reverse proxy into the otterwiki service with additional headers
+providing information about the user.
+

docs/auth_examples/header-auth/docker-compose.yaml

@@ -0,0 +1,22 @@
+version: '3'
+services:
+  otterwiki:
+    build: ../../..
+    restart: unless-stopped
+    ports:
+      # forward the http port to 8080
+      - "8080:80"
+    environment:
+      - SITE_NAME=Otter Header Auth
+      - AUTH_METHOD=PROXY_HEADER
+      - READ_ACCESS=APPROVED
+      - WRITE_ACCESS=APPROVED
+      - ATTACHMENT_ACCESS=APPROVED
+  caddy:
+    image: caddy:2
+    container_name: caddy
+    restart: unless-stopped
+    ports:
+      - 8081:8081
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro

otterwiki/auth.py

@@ -583,6 +583,7 @@ def get_all_user(self):
         return [current_user]
 
     def has_permission(self, permission, user):
+        if not user.is_authenticated: return False
         return permission.upper() in user.permissions