add http server root password protection (#757)

- Feature: Added `--security-config-path` option to zenserver to configure security settings
  - Expects a path to a .json file
  - Default is an empty path resulting in no extra security settings and legacy behavior
  - Current support is a top level filter of incoming http requests restricted to the `password` type
  - `password` type will check the `Authorization` header and match it to the selected authorization strategy
  - Currently the security settings is very basic and configured to a fixed username+password at startup

        {
            "http" {
                "root": {
                    "filter": {
                        "type": "password",
                        "config": {
	                          "password": {
	                              "username": "<username>",
	                              "password": "<password>"
	                          },
                            "protect-machine-local-requests": false,
	                          "unprotected-uris": [
	                              "/health/",
	                              "/health/info",
	                              "/health/version"
	                          ]
                        }
                    }
                }
            }
        }

1 files changed, 15 insertions, 5 deletions

diff --git a/src/zenserver/config/config.cpp b/src/zenserver/config/config.cpp
index 2b77df642..e36352dae 100644
--- a/src/zenserver/config/config.cpp
+++ b/src/zenserver/config/config.cpp
@@ -140,6 +140,7 @@ ZenServerConfiguratorBase::AddCommonConfigOptions(LuaConfig::Options& LuaOptions
 	LuaOptions.AddOption("server.contentdir"sv, ServerOptions.ContentDir, "content-dir"sv);
 	LuaOptions.AddOption("server.debug"sv, ServerOptions.IsDebug, "debug"sv);
 	LuaOptions.AddOption("server.clean"sv, ServerOptions.IsCleanStart, "clean"sv);
+	LuaOptions.AddOption("server.security.configpath"sv, ServerOptions.SecurityConfigPath, "security-config-path"sv);
 
 	////// network
 
@@ -186,6 +187,7 @@ struct ZenServerCmdLineOptions
 	std::string ContentDir;
 	std::string DataDir;
 	std::string BaseSnapshotDir;
+	std::string SecurityConfigPath;
 
 	ZenLoggingCmdLineOptions LoggingOptions;
 
@@ -300,6 +302,13 @@ ZenServerCmdLineOptions::AddCliOptions(cxxopts::Options& options, ZenServerConfi
 					   cxxopts::value<bool>(ServerOptions.HttpConfig.ForceLoopback)->default_value("false"),
 					   "<http forceloopback>");
 
+	options.add_option("network",
+					   "",
+					   "security-config-path",
+					   "Path to http security configuration file",
+					   cxxopts::value<std::string>(SecurityConfigPath),
+					   "<security config path>");
+
 #if ZEN_WITH_HTTPSYS
 	options.add_option("httpsys",
 					   "",
@@ -380,11 +389,12 @@ ZenServerCmdLineOptions::ApplyOptions(cxxopts::Options& options, ZenServerConfig
 			throw std::runtime_error(fmt::format("'--snapshot-dir' ('{}') must be a directory", ServerOptions.BaseSnapshotDir));
 	}
 
-	ServerOptions.SystemRootDir	  = MakeSafeAbsolutePath(SystemRootDir);
-	ServerOptions.DataDir		  = MakeSafeAbsolutePath(DataDir);
-	ServerOptions.ContentDir	  = MakeSafeAbsolutePath(ContentDir);
-	ServerOptions.ConfigFile	  = MakeSafeAbsolutePath(ConfigFile);
-	ServerOptions.BaseSnapshotDir = MakeSafeAbsolutePath(BaseSnapshotDir);
+	ServerOptions.SystemRootDir		 = MakeSafeAbsolutePath(SystemRootDir);
+	ServerOptions.DataDir			 = MakeSafeAbsolutePath(DataDir);
+	ServerOptions.ContentDir		 = MakeSafeAbsolutePath(ContentDir);
+	ServerOptions.ConfigFile		 = MakeSafeAbsolutePath(ConfigFile);
+	ServerOptions.BaseSnapshotDir	 = MakeSafeAbsolutePath(BaseSnapshotDir);
+	ServerOptions.SecurityConfigPath = MakeSafeAbsolutePath(SecurityConfigPath);
 
 	LoggingOptions.ApplyOptions(ServerOptions.LoggingConfig);
 }