Replace basic auth with cookie authentication (#440)

* Add logout functionality and button
* Make session age configurable

pkg/manager/config/config.go

@@ -19,6 +19,9 @@ const Metadata = "metadata"
 const Downloads = "downloads"
 const Username = "username"
 const Password = "password"
+const MaxSessionAge = "max_session_age"
+
+const DefaultMaxSessionAge = 60 * 60 * 1 // 1 hours
 
 const Database = "database"
 
@@ -31,6 +34,12 @@ const Host = "host"
 const Port = "port"
 const ExternalHost = "external_host"
 
+// key used to sign JWT tokens
+const JWTSignKey = "jwt_secret_key"
+
+// key used for session store
+const SessionStoreKey = "session_store_key"
+
 // scraping options
 const ScrapersPath = "scrapers_path"
 const ScraperUserAgent = "scraper_user_agent"
@@ -89,6 +98,14 @@ func GetDatabasePath() string {
 	return viper.GetString(Database)
 }
 
+func GetJWTSignKey() []byte {
+	return []byte(viper.GetString(JWTSignKey))
+}
+
+func GetSessionStoreKey() []byte {
+	return []byte(viper.GetString(SessionStoreKey))
+}
+
 func GetDefaultScrapersPath() string {
 	// default to the same directory as the config file
 	configFileUsed := viper.ConfigFileUsed()
@@ -202,6 +219,13 @@ func ValidateCredentials(username string, password string) bool {
 	return username == authUser && err == nil
 }
 
+// GetMaxSessionAge gets the maximum age for session cookies, in seconds.
+// Session cookie expiry times are refreshed every request.
+func GetMaxSessionAge() int {
+	viper.SetDefault(MaxSessionAge, DefaultMaxSessionAge)
+	return viper.GetInt(MaxSessionAge)
+}
+
 // Interface options
 func GetSoundOnPreview() bool {
 	viper.SetDefault(SoundOnPreview, true)
@@ -315,3 +339,21 @@ func IsValid() bool {
 	// TODO: check valid paths
 	return setPaths
 }
+
+// SetInitialConfig fills in missing required config fields
+func SetInitialConfig() error {
+	// generate some api keys
+	const apiKeyLength = 32
+
+	if string(GetJWTSignKey()) == "" {
+		signKey := utils.GenerateRandomKey(apiKeyLength)
+		Set(JWTSignKey, signKey)
+	}
+
+	if string(GetSessionStoreKey()) == "" {
+		sessionStoreKey := utils.GenerateRandomKey(apiKeyLength)
+		Set(SessionStoreKey, sessionStoreKey)
+	}
+
+	return Write()
+}