From cc57c78ba6f66d97b6a560e1721a065700831dc8 Mon Sep 17 00:00:00 2001
From: Monviech <79600909+Monviech@users.noreply.github.com>
Date: Sat, 29 Mar 2025 07:52:25 +0100
Subject: [PATCH] www/caddy: Add basic_auth support to handlers (#4620)

* www/caddy: Add basic_auth support to handlers

* www/caddy: Move scope of basic_auth into handler

* www/caddy: Changelog and small comments cleanup.

* www/caddy: Remove matcher from basic_auth since thats not used
---
 www/caddy/Makefile                                 |  2 +-
 www/caddy/pkg-descr                                |  4 ++++
 .../OPNsense/Caddy/forms/dialogHandle.xml          | 12 +++++++++++-
 .../mvc/app/models/OPNsense/Caddy/Caddy.xml        | 11 +++++++++++
 .../service/templates/OPNsense/Caddy/Caddyfile     | 14 +++++++-------
 5 files changed, 34 insertions(+), 9 deletions(-)

diff --git a/www/caddy/Makefile b/www/caddy/Makefile
index b8195f4da..c7bbdcac6 100644
--- a/www/caddy/Makefile
+++ b/www/caddy/Makefile
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		caddy
-PLUGIN_VERSION=		1.8.4
+PLUGIN_VERSION=		1.8.5
 PLUGIN_DEPENDS=		caddy-custom
 PLUGIN_COMMENT=		Modern Reverse Proxy with Automatic HTTPS, Dynamic DNS and Layer4 Routing
 PLUGIN_MAINTAINER=	cedrik@pischem.com
diff --git a/www/caddy/pkg-descr b/www/caddy/pkg-descr
index 745a694cf..d489a5da2 100644
--- a/www/caddy/pkg-descr
+++ b/www/caddy/pkg-descr
@@ -13,6 +13,10 @@ DOC: https://docs.opnsense.org/manual/how-tos/caddy.html
 Plugin Changelog
 ================
 
+1.8.5
+
+* Add: basic_auth per handler (opnsense/plugins/issues/4619)
+
 1.8.4
 
 * Add: Client Auth (mTLS) to domains (opnsense/plugins/issues/4089)
diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml
index 83cf1a5df..52fd8618e 100644
--- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml
+++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml
@@ -73,6 +73,16 @@
             <visible>false</visible>
         </grid_view>
     </field>
+    <field>
+        <id>handle.basicauth</id>
+        <label>Basic Auth</label>
+        <type>select_multiple</type>
+        <size>5</size>
+        <help><![CDATA[Select Users to restrict access to this path. If unset, any user is allowed access.]]></help>
+        <grid_view>
+            <visible>false</visible>
+        </grid_view>
+    </field>
     <field>
         <id>handle.ForwardAuth</id>
         <label>Forward Auth</label>
@@ -103,7 +113,7 @@
         <id>handle.HttpVersion</id>
         <label>HTTP Version</label>
         <type>dropdown</type>
-        <style>style_reverse_proxy</style>
+        <style>selectpicker style_reverse_proxy</style>
         <help><![CDATA[The default versions are highly recommended. Choose a HTTP version for the upstream destination. HTTP/3 (HTTP over QUIC) requires HTTPS, and only establishes connections to webservers that also support HTTP/3.]]></help>
         <advanced>true</advanced>
         <grid_view>
diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
index 0deb5239c..e07d56a0c 100644
--- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
+++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
@@ -383,6 +383,17 @@
                         </reverseproxy>
                     </Model>
                 </accesslist>
+                <basicauth type="ModelRelationField">
+                    <Model>
+                        <reverseproxy>
+                            <source>OPNsense.Caddy.Caddy</source>
+                            <items>reverseproxy.basicauth</items>
+                            <display>basicauthuser,description</display>
+                            <display_format>%s %s</display_format>
+                        </reverseproxy>
+                    </Model>
+                    <Multiple>Y</Multiple>
+                </basicauth>
                 <header type="ModelRelationField">
                     <Model>
                         <reverseproxy>
diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
index d5bdb2b66..fa96c74d4 100644
--- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
+++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
@@ -410,6 +410,7 @@ http://{{ domain }} {
 {% macro reverse_proxy_configuration(handle) %}
     {{ handle.HandleType }} {{ handle.HandlePath|default("") }} {
         {{ handle_accesslist(handle.accesslist) }}
+        {{ render_basic_auth(handle.basicauth) }}
         {# All IPs not matched by accesslist will continue processing #}
         {% if handle.ForwardAuth|default("0") == "1" %}
             {% include "OPNsense/Caddy/includeAuthProvider" %}
@@ -558,14 +559,11 @@ http://{{ domain }} {
 
 {#
 #   Macro: render_handles
-#   Purpose: Renders the handles in the correct order (path-specific first, then catch-all),
-#            including basic authentication configuration.
+#   Purpose: Renders the handles in the correct order (path-specific first, then catch-all).
 #   Parameters:
 #   @param handles (list): A list of handle objects to be rendered.
-#   @param basicauth_uuids (string): A comma-separated list of UUIDs for basic authentication.
 #}
-{% macro render_handles(handles, basicauth_uuids=None) %}
-    {{ render_basic_auth(basicauth_uuids) }}
+{% macro render_handles(handles) %}
     {% for handle in handles %}
         {% if handle.enabled|default("0") == "1" and handle.HandlePath %}
             {{ reverse_proxy_configuration(handle) }}
@@ -634,7 +632,8 @@ http://{{ domain }} {
                         {% set subdomain_handles = helpers.toList('Pischem.caddy.reverseproxy.handle') | selectattr('subdomain', 'equalto', subdomain['@uuid']) | list %}
                         {{ handle_accesslist(subdomain.accesslist, subdomain.FromDomain) }}
                         {# All IPs not matched by accesslist will continue processing #}
-                        {{ render_handles(subdomain_handles, subdomain.basicauth) }}
+                        {{ render_basic_auth(subdomain.basicauth) }}
+                        {{ render_handles(subdomain_handles) }}
                     }
                 {% endif %}
             {% endfor %}
@@ -642,7 +641,8 @@ http://{{ domain }} {
             {% set domain_handles = helpers.toList('Pischem.caddy.reverseproxy.handle') | selectattr('reverse', 'equalto', reverse['@uuid']) | selectattr('subdomain', 'undefined') | list %}
             {{ handle_accesslist(reverse.accesslist, reverse.FromDomain) }}
             {# All IPs not matched by accesslist will continue processing #}
-            {{ render_handles(domain_handles, reverse.basicauth) }}
+            {{ render_basic_auth(reverse.basicauth) }}
+            {{ render_handles(domain_handles) }}
         }
     {% endif %}
 {% endfor %}