feat(iroh-relay): allow to authenticate nodes via a HTTP POST request

iroh-relay/src/main.rs

@@ -11,6 +11,7 @@ use std::{
 
 use anyhow::{bail, Context as _, Result};
 use clap::Parser;
+use http::StatusCode;
 use iroh_base::NodeId;
 use iroh_relay::{
     defaults::{
@@ -22,8 +23,9 @@ use iroh_relay::{
 use n0_future::FutureExt;
 use serde::{Deserialize, Serialize};
 use tokio_rustls_acme::{caches::DirCache, AcmeConfig};
-use tracing::debug;
+use tracing::{debug, warn};
 use tracing_subscriber::{prelude::*, EnvFilter};
+use url::Url;
 
 /// The default `http_bind_port` when using `--dev`.
 const DEV_MODE_HTTP_PORT: u16 = 3340;
@@ -181,6 +183,14 @@ enum AccessConfig {
     Allowlist(Vec<NodeId>),
     /// Allows everyone, except these nodes.
     Denylist(Vec<NodeId>),
+    /// Performs a HTTP POST request to determine access for each node that connects to the relay.
+    ///
+    /// The request will have a header `X-Iroh-Node-Id` set to the hex-encoded node id attempting
+    /// to connect to the relay.
+    ///
+    /// To grant access, the HTTP endpoint must return a `200` response with `true` as the response text.
+    /// In all other cases, the node will be denied access.
+    Http(Url),
 }
 
 impl From<AccessConfig> for iroh_relay::server::AccessConfig {
@@ -215,10 +225,62 @@ impl From<AccessConfig> for iroh_relay::server::AccessConfig {
                     .boxed()
                 }))
             }
+            AccessConfig::Http(url) => {
+                let client = reqwest::Client::default();
+                iroh_relay::server::AccessConfig::Restricted(Box::new(move |node_id| {
+                    let client = client.clone();
+                    let url = url.clone();
+                    async move { http_access_check(&client, url, node_id).await }.boxed()
+                }))
+            }
         }
     }
 }
 
+#[tracing::instrument("http-access-check", skip_all, fields(node_id=%node_id.fmt_short()))]
+async fn http_access_check(
+    client: &reqwest::Client,
+    url: Url,
+    node_id: NodeId,
+) -> iroh_relay::server::Access {
+    use iroh_relay::server::Access;
+    debug!(%url, "Check relay access via HTTP POST");
+    let res = match client
+        .post(url)
+        .header("X-Iroh-NodeId", node_id.to_string())
+        .send()
+        .await
+    {
+        Ok(t) => t,
+        Err(err) => {
+            warn!("HTTP access check failed to retrieve response: {err}");
+            return Access::Deny;
+        }
+    };
+    if res.status() == StatusCode::OK {
+        match res.text().await {
+            Ok(text) if text == "true" => {
+                debug!("HTTP access check successful: grant access.");
+                Access::Allow
+            }
+            Ok(_) => {
+                warn!("HTTP access check return invalid response text: deny access.");
+                Access::Deny
+            }
+            Err(err) => {
+                warn!("HTTP access check failed to read response: {err}");
+                Access::Deny
+            }
+        }
+    } else {
+        debug!(
+            "HTTP access check response has status code {}: deny access",
+            res.status()
+        );
+        Access::Deny
+    }
+}
+
 impl Config {
     fn http_bind_addr(&self) -> SocketAddr {
         self.http_bind_addr