From a0f4b754f7e114d1dceee919a63e03906248f359 Mon Sep 17 00:00:00 2001
From: Nick Gerakines <12125+ngerakines@users.noreply.github.com>
Date: Tue, 5 Nov 2024 16:06:42 -0500
Subject: [PATCH] feature: bypass authentication when allow list is empty

Signed-off-by: Nick Gerakines <12125+ngerakines@users.noreply.github.com>
---
 src/http/handle_get_feed_skeleton.rs | 58 ++++++++++++++--------------
 1 file changed, 30 insertions(+), 28 deletions(-)

diff --git a/src/http/handle_get_feed_skeleton.rs b/src/http/handle_get_feed_skeleton.rs
index 7d1a321..686ea10 100644
--- a/src/http/handle_get_feed_skeleton.rs
+++ b/src/http/handle_get_feed_skeleton.rs
@@ -58,36 +58,38 @@ pub async fn handle_get_feed_skeleton(
 
     let feed_control = feed_control.unwrap();
 
-    let authorization = headers.get("Authorization").and_then(|value| {
-        value
-            .to_str()
-            .map(|inner_value| inner_value.to_string())
-            .ok()
-    });
-
-    let did = did_from_jwt(&web_context.pool, &web_context.external_base, authorization).await;
-
-    if let Err(err) = did {
-        tracing::error!(error = ?err, "failed to validate JWT");
-        return Ok(Json(FeedItemsView {
-            cursor: None,
-            feed: vec![FeedItemView {
-                post: feed_control.deny.clone(),
-            }],
-        })
-        .into_response());
-    }
+    if feed_control.allowed.len() > 0 {
+        let authorization = headers.get("Authorization").and_then(|value| {
+            value
+                .to_str()
+                .map(|inner_value| inner_value.to_string())
+                .ok()
+        });
+
+        let did = did_from_jwt(&web_context.pool, &web_context.external_base, authorization).await;
+
+        if let Err(err) = did {
+            tracing::error!(error = ?err, "failed to validate JWT");
+            return Ok(Json(FeedItemsView {
+                cursor: None,
+                feed: vec![FeedItemView {
+                    post: feed_control.deny.clone(),
+                }],
+            })
+            .into_response());
+        }
 
-    let did = did.unwrap();
+        let did = did.unwrap();
 
-    if !feed_control.allowed.contains(&did) {
-        return Ok(Json(FeedItemsView {
-            cursor: None,
-            feed: vec![FeedItemView {
-                post: feed_control.deny.clone(),
-            }],
-        })
-        .into_response());
+        if !feed_control.allowed.contains(&did) {
+            return Ok(Json(FeedItemsView {
+                cursor: None,
+                feed: vec![FeedItemView {
+                    post: feed_control.deny.clone(),
+                }],
+            })
+            .into_response());
+        }
     }
 
     let parsed_cursor = parse_cursor(feed_params.cursor);
-- 
2.51.2