feat(integrations): automatically disable googlereader/fever when not used

When there is no user of Fever/GoogleReader, there is no need to expose their
endpoints. This reduces quite a bit the exposition surface of miniflux, while
not breaking any existing deployments, and is pretty self-contained.

Author: jvoisin

internal/fever/handler.go

@@ -25,7 +25,9 @@ func Serve(router *mux.Router, store *storage.Storage) {
 	handler := &handler{store, router}
 
 	sr := router.PathPrefix("/fever").Subrouter()
-	sr.Use(newMiddleware(store).serve)
+	middleware := newMiddleware(store)
+	sr.Use(middleware.maybeUnauthorizedFever)
+	sr.Use(middleware.serve)
 	sr.HandleFunc("/", handler.serve).Name("feverEndpoint")
 }
 

internal/fever/middleware.go

@@ -9,6 +9,7 @@ import (
 	"net/http"
 
 	"miniflux.app/v2/internal/http/request"
+	"miniflux.app/v2/internal/http/response"
 	"miniflux.app/v2/internal/http/response/json"
 	"miniflux.app/v2/internal/storage"
 )
@@ -21,6 +22,20 @@ func newMiddleware(s *storage.Storage) *middleware {
 	return &middleware{s}
 }
 
+func (m *middleware) maybeUnauthorizedFever(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if m.store.IsFeverUsed() {
+			next.ServeHTTP(w, r)
+		} else {
+			builder := response.New(w, r)
+			builder.WithStatus(http.StatusUnauthorized)
+			builder.WithHeader("Content-Type", "text/plain")
+			builder.WithBody("Unauthorized")
+			builder.Write()
+		}
+	})
+}
+
 func (m *middleware) serve(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		clientIP := request.ClientIP(r)

internal/googlereader/handler.go

@@ -49,6 +49,7 @@ func Serve(router *mux.Router, store *storage.Storage) {
 	sr := router.PathPrefix("/reader/api/0").Subrouter()
 	sr.Use(middleware.handleCORS)
 	sr.Use(middleware.apiKeyAuth)
+	sr.Use(middleware.maybeUnauthorizedGoogleReader)
 	sr.Methods(http.MethodOptions)
 	sr.HandleFunc("/token", handler.tokenHandler).Methods(http.MethodGet).Name("Token")
 	sr.HandleFunc("/edit-tag", handler.editTagHandler).Methods(http.MethodPost).Name("EditTag")

internal/googlereader/middleware.go

@@ -25,6 +25,16 @@ func newMiddleware(s *storage.Storage) *middleware {
 	return &middleware{s}
 }
 
+func (m *middleware) maybeUnauthorizedGoogleReader(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if m.store.IsGoogleReaderUsed() {
+			next.ServeHTTP(w, r)
+		} else {
+			Unauthorized(w, r)
+		}
+	})
+}
+
 func (m *middleware) handleCORS(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Access-Control-Allow-Origin", "*")

internal/storage/integration.go

@@ -52,6 +52,13 @@ func (s *Storage) UserByFeverToken(token string) (*model.User, error) {
 	}
 }
 
+func (s *Storage) IsFeverUsed() bool {
+	query := `SELECT true FROM integrations WHERE fever_enabled=true`
+	var result bool
+	s.db.QueryRow(query).Scan(&result)
+	return result
+}
+
 // GoogleReaderUserCheckPassword validates the Google Reader hashed password.
 func (s *Storage) GoogleReaderUserCheckPassword(username, password string) error {
 	var hash string
@@ -105,6 +112,13 @@ func (s *Storage) GoogleReaderUserGetIntegration(username string) (*model.Integr
 	return &integration, nil
 }
 
+func (s *Storage) IsGoogleReaderUsed() bool {
+	query := `SELECT true FROM integrations WHERE googlereader_enabled=true`
+	var result bool
+	s.db.QueryRow(query).Scan(&result)
+	return result
+}
+
 // Integration returns user integration settings.
 func (s *Storage) Integration(userID int64) (*model.Integration, error) {
 	query := `