WebDAV: Allow authentication with auth token and no username #808 #3943

Signed-off-by: Michael Mayer <michael@photoprism.app>

internal/server/webdav_auth.go

@@ -40,7 +40,7 @@ func WebDAVAuth(conf *config.Config) gin.HandlerFunc {
 		// Fail if the username or password is empty, as
 		// this is not allowed under any circumstances.
 		if username == "" || password == "" || cacheKey == "" {
-			return "", "", "", false
+			return "", password, "", false
 		}
 
 		// To improve performance, check the cache for already authorized users.
@@ -80,7 +80,7 @@ func WebDAVAuth(conf *config.Config) gin.HandlerFunc {
 
 		// Use the value provided in the password field as auth secret if no username was provided
 		// and the format matches.
-		if username == "" && authToken == "" && rnd.IsAuthSecret(password) {
+		if (username == "" || username == "access-token") && authToken == "" && rnd.IsAuthSecret(password) {
 			authToken = password
 		}
 

internal/server/webdav_auth_test.go

@@ -1,6 +1,8 @@
 package server
 
 import (
+	"encoding/base64"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -53,7 +55,24 @@ func TestWebDAVAuth(t *testing.T) {
 		}
 
 		sess := entity.SessionFixtures.Get("alice_token_webdav")
-		header.SetAuthorization(c.Request, sess.AuthToken())
+		basicAuth := []byte(fmt.Sprintf("access-token:%s", sess.AuthToken()))
+		c.Request.Header.Add(header.Auth, fmt.Sprintf("%s %s", header.AuthBasic, base64.StdEncoding.EncodeToString(basicAuth)))
+
+		webdavHandler(c)
+
+		assert.Equal(t, http.StatusOK, c.Writer.Status())
+		assert.Equal(t, "", c.Writer.Header().Get("WWW-Authenticate"))
+	})
+	t.Run("AliceTokenWebdavWithoutUsername", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		c, _ := gin.CreateTestContext(w)
+		c.Request = &http.Request{
+			Header: make(http.Header),
+		}
+
+		sess := entity.SessionFixtures.Get("alice_token_webdav")
+		basicAuth := []byte(fmt.Sprintf(":%s", sess.AuthToken()))
+		c.Request.Header.Add(header.Auth, fmt.Sprintf("%s %s", header.AuthBasic, base64.StdEncoding.EncodeToString(basicAuth)))
 
 		webdavHandler(c)