started on auth

P2P/Http.hs

@@ -119,6 +119,7 @@ type GetAPI
 	:> BypassUUIDs
 	:> AssociatedFileParam
 	:> OffsetParam
+	:> AuthHeader
 	:> StreamGet NoFraming OctetStream
 		(Headers '[DataLengthHeader] (SourceIO B.ByteString))
 
@@ -132,6 +133,7 @@ serveGet
 	-> [B64UUID Bypass]
 	-> Maybe B64FilePath
 	-> Maybe Offset
+	-> Maybe Auth
 	-> Handler (Headers '[DataLengthHeader] (S.SourceT IO B.ByteString))
 serveGet = undefined
 
@@ -143,6 +145,7 @@ clientGet
 	-> [B64UUID Bypass]
 	-> Maybe B64FilePath
 	-> Maybe Offset
+	-> Maybe Auth
 	-> ClientM (Headers '[DataLengthHeader] (S.SourceT IO B.ByteString))
 clientGet (ProtocolVersion ver) = case ver of
 	3 -> v3 V3
@@ -563,3 +566,5 @@ type OffsetParam = QueryParam "offset" Offset
 type DataLengthHeader = Header "X-git-annex-data-length" Integer
 
 type LockIDParam = QueryParam' '[Required] "lockid" LockID
+
+type AuthHeader = Header "Authorization" Auth

P2P/Http/State.hs

@@ -26,12 +26,14 @@ import Control.Concurrent.STM
 
 data P2PHttpServerState = P2PHttpServerState
 	{ acquireP2PConnection :: AcquireP2PConnection
+	, getServerMode :: GetServerMode
 	, openLocks :: TMVar (M.Map LockID Locker)
 	}
 
-mkP2PHttpServerState :: AcquireP2PConnection -> IO P2PHttpServerState
-mkP2PHttpServerState acquireconn = P2PHttpServerState
+mkP2PHttpServerState :: AcquireP2PConnection -> GetServerMode -> IO P2PHttpServerState
+mkP2PHttpServerState acquireconn getservermode = P2PHttpServerState
 	<$> pure acquireconn
+	<*> pure getservermode
 	<*> newTMVarIO mempty
 
 withP2PConnection
@@ -61,6 +63,8 @@ withP2PConnection apiver st cu su bypass connaction = do
 		, connectionServerMode = P2P.ServeReadWrite -- XXX auth
 		}
 
+type GetServerMode = IsSecure -> Maybe BasicAuthData -> Maybe P2P.ServerMode
+
 data ConnectionParams = ConnectionParams
 	{ connectionProtocolVersion :: P2P.ProtocolVersion
 	, connectionServerUUID :: UUID

P2P/Http/Types.hs

@@ -98,6 +98,12 @@ data LockResult = LockResult Bool (Maybe LockID)
 newtype UnlockRequest = UnlockRequest Bool
 	deriving (Show, Generic, NFData)
 
+-- Not using servant's build-in basic authentication support,
+-- because whether authentication is needed depends on server
+-- configuration.
+data Auth = Auth T.Text T.Text
+	deriving (Show, Generic, NFData)
+
 newtype ConnectionKeepAlive = ConnectionKeepAlive T.Text
 
 connectionKeepAlive :: ConnectionKeepAlive