release: open days older than the first entry ever logged (#4)

## Fixed

- Days older than the first entry ever logged can now be opened. Picking a
  date from before anything was recorded landed on a dead end.

## Changed

- Releases are built by CI. Merging this pull request builds the image,
  tags it `vYYYYMMDD-N` and `latest`, pushes both, and creates the git
  tag. Nothing is built locally any more.
- `make image`, `push`, `release`, `seed`, `icons` and `vendor` are gone;
  the Makefile is down from 151 lines to 71. The two rare commands are
  written out in the README.
- Every push to `dev` now runs `make check` in CI.

## Deployment

No new or renamed environment variables, and `compose.yaml` is unchanged —
nothing to copy to the server this time. Pull the new image once CI reports
the build finished.

---------

Co-authored-by: Esa Kataja <[email protected]>
Reviewed-on: #4

.env.example

@@ -5,18 +5,13 @@
 REPO=registry.example.com/you/foodster
 TAG=latest
 
+# Shared household password. The app will not start without it.
+PASSWORD=changeme
+
 # Hostname Traefik routes to. Kept here rather than in compose.yaml so no
 # infrastructure detail is committed.
 HOST=foodster.example.com
 
-# The Traefik middleware that authenticates the app. The app itself has no
-# login, so this is the whole of its access control — an unset or misspelt
-# name takes the router out of service, which is the right way to fail.
-AUTH=authelia@docker
-
-# Traefik certificate resolver issuing the TLS certificate for HOST.
-CERTRESOLVER=letsencrypt
-
 # Anything other than prod is written into the browser tab title, so a dev
 # instance open beside the real one can be told apart.
 ENV=prod

Makefile

@@ -4,7 +4,7 @@ COMPOSE ?= podman compose
 BIN     := foodster
 PKG     := ./cmd/foodster
 
-# Registry coordinates, hostname, TZ. Gitignored.
+# Shared password and TZ live here. Gitignored.
 ifneq (,$(wildcard .env))
 include .env
 export
@@ -28,7 +28,7 @@ build: generate ## Build ./foodster
 		-ldflags="-s -w -X main.version=dev" -o $(BIN) $(PKG)
 
 run: generate ## Run locally on :8080 (database in ./data)
-	ENV=dev go run $(PKG)
+	PASSWORD=$${PASSWORD:-dev} ENV=dev go run $(PKG)
 
 test: generate ## Run unit tests
 	go test ./...

PRD.md

@@ -25,12 +25,12 @@ polished, it may be released as FOSS under MIT.
 - No grocery list generation (possible future add-on).
 - No per-recipe ingredient tracking — meals are just names.
 - No calendar/scheduling with times, reminders, or calendar exports.
-- No user accounts, per-person profiles, or permissions *in the app*.
-  Authentication is the reverse proxy's job (§9).
+- No user accounts, per-person profiles, or permissions. A single shared
+  password gates the whole app (§9).
 - No nutrition tracking, calorie counting, or dietary-goal optimization.
 - No mobile-native apps. Web only (mobile-friendly responsive is enough).
-- No per-user accounts or sessions in the app. It *is* reachable from the
-  internet (§9, §10), behind Authelia at the proxy.
+- No per-user accounts or sessions. The app *is* reachable from the internet
+  (§9, §10), gated by a single shared password over TLS.
 
 ## 4. Delivery stages
 
@@ -72,9 +72,9 @@ weighting to be meaningful (a few weeks of logged meals).
 
 ## 5. Users
 
-A single household. One shared instance, no per-person accounts. Everyone who
-gets past Authelia sees and edits the same log; the app draws no distinction
-between them.
+A single household. One shared instance, no per-person accounts. Anyone on the
+home network who knows the shared password can open the app and interact with
+it.
 
 The interface is written in **Finnish** — every user of this instance is a
 Finnish speaker, so there is no i18n layer and no language switcher. Strings
@@ -350,21 +350,21 @@ build and no asset bundler.
   to UTC would shift logged dinners to the wrong calendar day. `time/tzdata`
   is imported because the runtime image carries no zoneinfo. All date logic
   uses that location explicitly and never `time.Local`.
-- **Auth**: none in the app. Every route is served unauthenticated, because
-  the only client that can reach the app is Traefik, which forwards each
-  request to **Authelia** first. Sessions, brute-force protection and
-  multi-factor are configured there once for every service on the host.
-  Deliberately not reimplemented per app: the earlier in-app HTTP Basic layer
-  meant two prompts for one door, and the weaker of the two was the one
-  holding a shared password.
-- **Exposure**: served on a public hostname behind Traefik, which terminates
-  TLS. Two invariants carry the whole security model, and both are asserted
-  in `compose.yaml`. The router names the Authelia middleware through `AUTH`
-  — unset or misspelt, Traefik takes the router out of service, so a typo
-  fails shut. And the container publishes no ports, so it is reachable only
-  over the shared proxy network; publishing `8080` would expose an
-  unauthenticated plaintext copy on the host. `/healthz` returns only the
-  version and is safe to bypass in Authelia for monitoring.
+- **Auth**: HTTP Basic with one shared household password read from
+  `PASSWORD`; the username is ignored. Compared using
+  `subtle.ConstantTimeCompare` over SHA-256 digests so neither the value nor
+  its length leaks through timing. `/healthz` is the only route outside auth.
+- **Exposure**: the app is served on a public hostname behind Traefik, which
+  terminates TLS, so Basic credentials are encrypted in transit. A shared
+  password is therefore the only thing between the internet and the app, and
+  it is guarded by a per-address rate limiter: five wrong guesses, then one
+  per ten seconds, answered with `429`. Only requests that actually present
+  a wrong password spend the allowance — a request with no `Authorization`
+  header is the normal browser handshake that opens every session.
+  `X-Forwarded-For` is trusted only when the connection arrived from a
+  private address, so a direct client cannot forge a new identity per
+  attempt. None of this substitutes for a strong password; it only removes
+  brute force as a practical route.
 - **Containers**: built with Podman in development, run under Docker Compose
   in production. Images are OCI, so one image works with both engines.
 
@@ -406,10 +406,8 @@ the server and run with Docker Compose.
   `.env.example`):
   Names carry no application prefix: the container namespaces them already.
   - `REPO` and `TAG` — image coordinates.
-  - `AUTH` — the Traefik middleware that authenticates the app, e.g.
-    `authelia@docker`. Required; it is the app's only access control.
-  - `HOST` and `CERTRESOLVER` — the hostname Traefik matches on and the
-    resolver that issues its certificate.
+  - `PASSWORD` — the shared password. Required; the app refuses to start
+    without it.
   - `DB` — database file path, default `./data/foodster.db`. The directory is
     created on startup if missing.
   - `ENV` — anything but `prod` is prefixed to the browser tab title, so a
@@ -424,9 +422,8 @@ the server and run with Docker Compose.
   doing so would put an unencrypted copy of the app on the host, bypassing
   the proxy. The hostname lives in `.env` rather than `compose.yaml`, so no
   infrastructure detail is committed.
-- **Health**: `GET /healthz` returns the build version and nothing else, so it
-  is safe to exempt in Authelia. There is no Docker `HEALTHCHECK` directive,
-  because a `scratch` image
+- **Health**: `GET /healthz` returns the build version and is exempt from
+  auth. There is no Docker `HEALTHCHECK` directive, because a `scratch` image
   has no shell to run one and `restart: unless-stopped` already covers a dead
   process. Adding one would mean giving the binary a `-healthcheck` flag that
   calls its own endpoint.

README.md

@@ -55,7 +55,7 @@ One static Go binary. No Node.js, no bundler, no separate database server.
 | Interactivity | [Datastar](https://data-star.dev) — signals and DOM patching in one ~11 kB script |
 | Styling | hand-written CSS, `light-dark()` for themes |
 | Database | SQLite via `modernc.org/sqlite` (pure Go) |
-| Auth | none in-app — Authelia, via a Traefik forward-auth middleware |
+| Auth | HTTP Basic, one shared household password |
 | Runtime image | `FROM scratch` |
 
 Working on it: [CONTRIBUTING.md](CONTRIBUTING.md) — branches, commit messages,
@@ -196,6 +196,7 @@ Everything is environment variables. `.env` is gitignored; start from
 
 | Variable | Default | Purpose |
 |---|---|---|
+| `PASSWORD` | *required* | Shared password. The app will not start without it. |
 | `DB` | `./data/foodster.db` | SQLite file path; the directory is created if missing. |
 | `ENV` | `prod` | Anything else is prefixed to the tab title (`dev · Foodster`). |
 | `ADDR` | `:8080` | Listen address. Only useful for a second local instance. |
@@ -204,8 +205,6 @@ Everything is environment variables. `.env` is gitignored; start from
 | `REPO` | *required to run* | Image repository, no tag. Used by `compose.yaml`. |
 | `TAG` | `latest` | Tag to run under compose. |
 | `HOST` | *required to run* | Hostname Traefik routes to. |
-| `AUTH` | *required to run* | Traefik middleware that authenticates the app, e.g. `authelia@docker`. |
-| `CERTRESOLVER` | *required to run* | Traefik certificate resolver for `HOST`. |
 
 Names carry no prefix: the container gives them their own namespace already.
 `PUID`/`PGID` are the exception — `UID` is read-only in bash, so a value set
@@ -255,27 +254,24 @@ docker compose restart
 
 ## Security
 
-**The app has no authentication of its own.** It trusts every request it
-receives, because the only thing that can reach it is Traefik, and Traefik
-hands each request to Authelia first. Access control, sessions, brute-force
-protection and multi-factor all live there, where they are configured once
-for every service on the host instead of reimplemented per app.
+Access is a single shared password over HTTP Basic — no accounts, no
+sessions. Credentials are compared in constant time over SHA-256 digests, so
+neither the password nor its length leaks through timing.
 
-Two things make that safe, and both must hold:
+The app is served on a public hostname behind Traefik, which terminates TLS,
+so the credentials are encrypted in transit. That leaves the password as the
+only thing between the internet and the app, so wrong guesses are rate
+limited per client address: five in a burst, then one per ten seconds,
+answered with `429`. Requests carrying no `Authorization` header are not
+charged — that is the handshake every browser session begins with, and
+counting it would lock the household out for simply opening the app.
 
-- **`AUTH` names the Authelia middleware** on the router. It is the whole of
-  the app's access control. Traefik takes a router out of service when its
-  middleware does not resolve, so a typo fails shut rather than open.
-- **The container publishes no ports.** It is reachable only over the shared
-  `traefik` network. Publishing `8080` would put an unauthenticated,
-  unencrypted copy of the app on the host and defeat both of the above.
+`X-Forwarded-For` is trusted only when the connection came from a private
+address, meaning it arrived through the proxy. A client connecting directly
+could otherwise forge a new address per attempt and skip the limiter.
 
-`/healthz` returns nothing but the version, so it is safe to bypass in
-Authelia if a monitor needs to poll it from outside.
-
-Earlier versions carried HTTP Basic auth and a per-IP guess limiter. Both
-were removed once Authelia was in front: two prompts for one door, and the
-weaker of the two was the one holding a shared password.
+**None of this replaces a strong `PASSWORD`.** Rate limiting removes
+brute force as a practical route; it does not make a guessable password safe.
 
 ## Mockups
 

cmd/foodster/main.go

@@ -7,6 +7,8 @@ package main
 import (
 	"cmp"
 	"context"
+	"crypto/sha256"
+	"crypto/subtle"
 	"database/sql"
 	"embed"
 	"errors"
@@ -74,11 +76,16 @@ func run() error {
 	}
 	defer db.Close()
 
-	// Importing is an offline chore: no server started, nothing to serve.
+	// Importing is an offline chore: no password needed, no server started.
 	if *importPath != "" {
 		return runImport(db, *importPath)
 	}
 
+	password := os.Getenv("PASSWORD")
+	if password == "" {
+		return errors.New("PASSWORD is not set")
+	}
+
 	// Fail rather than fall back to UTC: a silently wrong zone shifts logged
 	// dinners onto the wrong calendar day, which is invisible until the
 	// history is already corrupt.
@@ -98,7 +105,7 @@ func run() error {
 	// response blocks every other request behind it.
 	srv := &http.Server{
 		Addr:              addr,
-		Handler:           routes(db, loc),
+		Handler:           routes(db, loc, password),
 		ReadHeaderTimeout: 10 * time.Second,
 		WriteTimeout:      30 * time.Second,
 		IdleTimeout:       120 * time.Second,
@@ -161,11 +168,7 @@ func openDB(path string) (*sql.DB, error) {
 	return db, nil
 }
 
-// routes serves the app unauthenticated. Access control is the reverse proxy's
-// job: Traefik forwards every request to Authelia before it reaches here, so a
-// second password in front of it only ever meant two prompts for one door. The
-// container publishes no ports, so nothing but the proxy can reach it.
-func routes(db *sql.DB, loc *time.Location) http.Handler {
+func routes(db *sql.DB, loc *time.Location, password string) http.Handler {
 	// Go's mime table has no entry for .webmanifest, and a manifest served as
 	// octet-stream is ignored by the browser.
 	_ = mime.AddExtensionType(".webmanifest", "application/manifest+json")
@@ -188,13 +191,51 @@ func routes(db *sql.DB, loc *time.Location) http.Handler {
 	mux.HandleFunc("POST /ruuat/poista", a.deleteDish)
 	mux.HandleFunc("POST /ruuat/tuonti", a.importDishes)
 
-	// /healthz is an ordinary route now that the app has no auth of its own.
-	// It reveals only the version, so an Authelia bypass rule for it is safe if
-	// a monitor needs to poll from outside the container network.
-	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, r *http.Request) {
+	// /healthz stays outside auth so a monitor or reverse proxy can reach it.
+	root := http.NewServeMux()
+	root.HandleFunc("GET /healthz", func(w http.ResponseWriter, r *http.Request) {
 		fmt.Fprintln(w, version)
 	})
-	return mux
+	root.Handle("/", auth(password, mux))
+	return root
+}
+
+// auth gates everything behind one shared household password. There are no
+// accounts, so the username is ignored (PRD §9).
+func auth(password string, next http.Handler) http.Handler {
+	want := sha256.Sum256([]byte(password))
+	guesses := newThrottle()
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, given, ok := r.BasicAuth()
+
+		// A request with no Authorization header is the normal browser
+		// handshake, not a guess: every session opens with one. Challenge it
+		// without spending the address's allowance.
+		if !ok {
+			challenge(w)
+			return
+		}
+
+		// Hashing first keeps the comparison a fixed length, so neither the
+		// password nor its length leaks through timing.
+		got := sha256.Sum256([]byte(given))
+		if subtle.ConstantTimeCompare(got[:], want[:]) != 1 {
+			if !guesses.allow(clientIP(r)) {
+				http.Error(w, "Liikaa yrityksiä.", http.StatusTooManyRequests)
+				return
+			}
+			challenge(w)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
+
+func challenge(w http.ResponseWriter) {
+	w.Header().Set("WWW-Authenticate", `Basic realm="Foodster", charset="UTF-8"`)
+	http.Error(w, "Unauthorized", http.StatusUnauthorized)
 }
 
 // today is the current calendar day in the configured location, truncated to

cmd/foodster/main_test.go

@@ -306,23 +306,63 @@ func TestDuplicateNamesAreCaseInsensitive(t *testing.T) {
 	}
 }
 
-// The app carries no authentication of its own — Authelia in front of Traefik
-// does that — so the only thing left to assert is that every route answers
-// without credentials. A 401 from here would mean auth crept back in.
-func TestRoutesNeedNoCredentials(t *testing.T) {
+func TestAuth(t *testing.T) {
+	handler := auth("hunter2", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusTeapot) // proves we reached the wrapped handler
+	}))
+
+	cases := []struct {
+		name     string
+		user     string
+		pass     string
+		withAuth bool
+		want     int
+	}{
+		{"correct password", "", "hunter2", true, http.StatusTeapot},
+		{"username is ignored", "anyone", "hunter2", true, http.StatusTeapot},
+		{"wrong password", "", "wrong", true, http.StatusUnauthorized},
+		{"empty password", "", "", true, http.StatusUnauthorized},
+		{"no credentials", "", "", false, http.StatusUnauthorized},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, "/", nil)
+			if c.withAuth {
+				r.SetBasicAuth(c.user, c.pass)
+			}
+			w := httptest.NewRecorder()
+			handler.ServeHTTP(w, r)
+
+			if w.Code != c.want {
+				t.Errorf("status = %d, want %d", w.Code, c.want)
+			}
+			if c.want == http.StatusUnauthorized && w.Header().Get("WWW-Authenticate") == "" {
+				t.Error("401 without a WWW-Authenticate header; the browser will not prompt")
+			}
+		})
+	}
+}
+
+func TestHealthzSkipsAuth(t *testing.T) {
 	db, err := openDB(t.TempDir() + "/test.db")
 	if err != nil {
 		t.Fatalf("openDB: %v", err)
 	}
 	defer db.Close()
 
-	h := routes(db, time.UTC)
+	h := routes(db, time.UTC, "hunter2")
 
-	for _, path := range []string{"/healthz", "/", "/ruuat"} {
-		w := httptest.NewRecorder()
-		h.ServeHTTP(w, httptest.NewRequest(http.MethodGet, path, nil))
-		if w.Code != http.StatusOK {
-			t.Errorf("GET %s = %d, want 200", path, w.Code)
-		}
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/healthz", nil))
+	if w.Code != http.StatusOK {
+		t.Errorf("/healthz without credentials = %d, want 200", w.Code)
+	}
+
+	// Everything else must still be gated.
+	w = httptest.NewRecorder()
+	h.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/", nil))
+	if w.Code != http.StatusUnauthorized {
+		t.Errorf("/ without credentials = %d, want 401", w.Code)
 	}
 }

cmd/foodster/throttle.go

@@ -0,0 +1,111 @@
+package main
+
+import (
+	"net"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"golang.org/x/time/rate"
+)
+
+// The app is reachable from the internet, so a shared password needs more
+// than a sleep in front of it. These allow a family fumbling the password a
+// handful of quick retries, then roughly six a minute — useless for guessing,
+// unnoticeable to anyone who knows it.
+//
+// This buys time; it is not the defence. A strong password is.
+const (
+	guessBurst    = 5
+	guessInterval = 10 * time.Second
+
+	// Bounds on the per-IP table, so a spray across many addresses cannot
+	// grow it without limit.
+	throttleMaxEntries = 4096
+	throttleIdle       = 15 * time.Minute
+)
+
+type visitor struct {
+	limiter *rate.Limiter
+	seen    time.Time
+}
+
+// throttle rate-limits failed password attempts per client address.
+//
+// ponytail: one mutex over one map. At household traffic this will never be
+// contended; shard it if that ever stops being true.
+type throttle struct {
+	mu       sync.Mutex
+	visitors map[string]*visitor
+}
+
+func newThrottle() *throttle {
+	return &throttle{visitors: make(map[string]*visitor)}
+}
+
+// allow reports whether another wrong guess from this address is permitted.
+func (t *throttle) allow(ip string) bool {
+	now := time.Now()
+
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	if len(t.visitors) >= throttleMaxEntries {
+		t.pruneLocked(now)
+	}
+
+	v := t.visitors[ip]
+	if v == nil {
+		v = &visitor{limiter: rate.NewLimiter(rate.Every(guessInterval), guessBurst)}
+		t.visitors[ip] = v
+	}
+	v.seen = now
+
+	return v.limiter.Allow()
+}
+
+func (t *throttle) pruneLocked(now time.Time) {
+	for ip, v := range t.visitors {
+		if now.Sub(v.seen) > throttleIdle {
+			delete(t.visitors, ip)
+		}
+	}
+	// Still full of live entries: a spray is in progress. Drop the lot rather
+	// than grow without bound. Everyone gets a fresh allowance, which is the
+	// safe direction to fail — the password is still required.
+	if len(t.visitors) >= throttleMaxEntries {
+		clear(t.visitors)
+	}
+}
+
+// clientIP resolves the address to rate-limit against.
+//
+// X-Forwarded-For is only believed when the connection itself came from a
+// private address, meaning it arrived through the reverse proxy on the
+// container network. A client connecting directly could otherwise forge a
+// fresh address on every attempt and walk straight past the limiter.
+func clientIP(r *http.Request) string {
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		host = r.RemoteAddr
+	}
+
+	ip := net.ParseIP(host)
+	if ip == nil || !(ip.IsPrivate() || ip.IsLoopback()) {
+		return host
+	}
+
+	forwarded := r.Header.Get("X-Forwarded-For")
+	if forwarded == "" {
+		return host
+	}
+	// The nearest proxy appends the address it saw, so the last entry is the
+	// trustworthy one; anything before it was supplied by the client.
+	parts := strings.Split(forwarded, ",")
+	last := strings.TrimSpace(parts[len(parts)-1])
+	if net.ParseIP(last) == nil {
+		return host
+	}
+	return last
+}

cmd/foodster/throttle_test.go

@@ -0,0 +1,110 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestThrottleBlocksRepeatedGuesses(t *testing.T) {
+	th := newThrottle()
+
+	for i := 0; i < guessBurst; i++ {
+		if !th.allow("198.51.100.7") {
+			t.Fatalf("guess %d refused inside the burst", i+1)
+		}
+	}
+	if th.allow("198.51.100.7") {
+		t.Error("guess allowed past the burst")
+	}
+	// A different address has its own allowance.
+	if !th.allow("198.51.100.8") {
+		t.Error("a second address was blocked by the first one's guesses")
+	}
+}
+
+func TestClientIPIgnoresForwardedHeaderFromDirectClients(t *testing.T) {
+	// Connecting straight from the internet: X-Forwarded-For is attacker
+	// input, so a forged value must not create a fresh rate-limit bucket.
+	r := httptest.NewRequest(http.MethodGet, "/", nil)
+	r.RemoteAddr = "203.0.113.9:44321"
+	r.Header.Set("X-Forwarded-For", "1.2.3.4")
+
+	if got := clientIP(r); got != "203.0.113.9" {
+		t.Errorf("clientIP = %q, want the real peer 203.0.113.9", got)
+	}
+}
+
+func TestClientIPTakesLastForwardedEntryBehindProxy(t *testing.T) {
+	// Arriving through Traefik on the container network. The proxy appends
+	// the address it saw, so the last entry is the trustworthy one and the
+	// forged entry in front of it must be ignored.
+	r := httptest.NewRequest(http.MethodGet, "/", nil)
+	r.RemoteAddr = "172.18.0.4:53000"
+	r.Header.Set("X-Forwarded-For", "1.2.3.4, 198.51.100.22")
+
+	if got := clientIP(r); got != "198.51.100.22" {
+		t.Errorf("clientIP = %q, want 198.51.100.22", got)
+	}
+}
+
+func TestClientIPFallsBackWhenNoForwardedHeader(t *testing.T) {
+	r := httptest.NewRequest(http.MethodGet, "/", nil)
+	r.RemoteAddr = "172.18.0.4:53000"
+
+	if got := clientIP(r); got != "172.18.0.4" {
+		t.Errorf("clientIP = %q, want 172.18.0.4", got)
+	}
+}
+
+func TestAuthRateLimitsWrongPasswords(t *testing.T) {
+	handler := auth("hunter2", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusTeapot)
+	}))
+
+	send := func(pass string) int {
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		r.RemoteAddr = "203.0.113.5:40000"
+		r.SetBasicAuth("", pass)
+		w := httptest.NewRecorder()
+		handler.ServeHTTP(w, r)
+		return w.Code
+	}
+
+	for i := 0; i < guessBurst; i++ {
+		if code := send("wrong"); code != http.StatusUnauthorized {
+			t.Fatalf("guess %d returned %d, want 401", i+1, code)
+		}
+	}
+	if code := send("wrong"); code != http.StatusTooManyRequests {
+		t.Errorf("guess past the burst returned %d, want 429", code)
+	}
+}
+
+func TestAuthDoesNotSpendAllowanceOnTheBrowserHandshake(t *testing.T) {
+	handler := auth("hunter2", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusTeapot)
+	}))
+
+	// Every session opens with a credential-less request. Charging those
+	// would lock a family out by simply opening the app a few times.
+	for i := 0; i < guessBurst*4; i++ {
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		r.RemoteAddr = "203.0.113.6:40000"
+		w := httptest.NewRecorder()
+		handler.ServeHTTP(w, r)
+		if w.Code != http.StatusUnauthorized {
+			t.Fatalf("handshake %d returned %d, want 401", i+1, w.Code)
+		}
+	}
+
+	// The correct password still works afterwards.
+	r := httptest.NewRequest(http.MethodGet, "/", nil)
+	r.RemoteAddr = "203.0.113.6:40000"
+	r.SetBasicAuth("", "hunter2")
+	w := httptest.NewRecorder()
+	handler.ServeHTTP(w, r)
+	if w.Code != http.StatusTeapot {
+		t.Errorf("correct password returned %d, want the wrapped handler", w.Code)
+	}
+}

cmd/foodster/views.templ

@@ -143,9 +143,8 @@ templ page(title, current string) {
 			<title>{ pageTitle(title) }</title>
 			<link rel="icon" href="/static/favicon.svg" type="image/svg+xml"/>
 			<link rel="apple-touch-icon" href="/static/apple-touch-icon.png"/>
-			<!-- use-credentials: the manifest fetch is anonymous by default, so
-			     behind Authelia it would be redirected to the login page and
-			     the manifest quietly ignored. -->
+			<!-- use-credentials: the manifest is fetched behind Basic auth and
+			     would otherwise come back 401 and be ignored. -->
 			<link rel="manifest" href="/static/manifest.webmanifest" crossorigin="use-credentials"/>
 			<link rel="stylesheet" href="/static/app.css"/>
 			<!-- Not deferred: it applies the stored theme before first paint. -->

compose.yaml

@@ -15,25 +15,19 @@ services:
       - ./data:/data
 
     environment:
+      PASSWORD: ${PASSWORD:?set PASSWORD in .env}
       DB: /data/foodster.db
       ENV: ${ENV:-prod}
       TZ: ${TZ:-Europe/Helsinki}
 
     # No published ports: Traefik reaches the container over the shared
     # network. Publishing 8080 as well would put an unencrypted copy of the
-    # app on the host, bypassing TLS — and, now that the app has no login of
-    # its own, bypassing authentication entirely.
-    #
-    # The middleware is the only thing standing in front of the app. If AUTH
-    # is unset or names a middleware Traefik does not know, Traefik takes the
-    # router out of service rather than serving it open, so a typo fails shut.
+    # app on the host, bypassing TLS.
     labels:
       - traefik.enable=true
       - traefik.http.routers.foodster.entrypoints=websecure
       - traefik.http.routers.foodster.rule=Host(`${HOST:?set HOST in .env}`)
-      # Naming a resolver implies tls=true, so this is one label, not two.
-      - traefik.http.routers.foodster.tls.certresolver=${CERTRESOLVER:?set CERTRESOLVER in .env}
-      - traefik.http.routers.foodster.middlewares=${AUTH:?set AUTH in .env, e.g. authelia@docker}
+      - traefik.http.routers.foodster.tls=true
       - traefik.http.services.foodster.loadbalancer.server.port=8080
       - traefik.docker.network=traefik
     networks:

go.mod

@@ -6,6 +6,7 @@ tool github.com/a-h/templ/cmd/templ
 
 require (
 	github.com/a-h/templ v0.3.1020
+	golang.org/x/time v0.15.0
 	modernc.org/sqlite v1.58.0
 )
 

go.sum

@@ -50,6 +50,8 @@ golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
 golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

scripts/smoke.sh

@@ -1,10 +1,7 @@
 #!/bin/sh
-# End-to-end check of a running Foodster: static assets, the logger and the
-# bundle import flow. Builds its own binary, uses a scratch database and a
-# spare port, and cleans up after itself, so it never touches a real instance.
-#
-# There is nothing to authenticate as: the app is served behind Authelia and
-# has no login of its own.
+# End-to-end check of a running Foodster: auth, static assets and the bundle
+# import flow. Builds its own binary, uses a scratch database and a spare
+# port, and cleans up after itself, so it never touches a real instance.
 #
 # Run it with `make smoke`.
 
@@ -13,6 +10,7 @@ set -eu
 cd "$(dirname "$0")/.."
 
 addr=127.0.0.1:8099
+pass=smoke
 
 # Dates are relative, never literal. A hardcoded one turns into "some day in
 # the past" at the next midnight, and the assertions quietly start meaning
@@ -24,7 +22,7 @@ trap 'kill ${srv:-0} 2>/dev/null || true; rm -rf "$tmp"' EXIT
 
 go build -o "$tmp/foodster" ./cmd/foodster
 
-DB="$tmp/smoke.db" ADDR="$addr" \
+PASSWORD="$pass" DB="$tmp/smoke.db" ADDR="$addr" \
 	"$tmp/foodster" >"$tmp/server.log" 2>&1 &
 srv=$!
 
@@ -63,19 +61,22 @@ refute() {
 
 echo "smoke: http://$addr"
 
-check "healthz answers" \
+check "unauthenticated request is refused" \
+	"$(curl -s -o /dev/null -w '%{http_code}' "http://$addr/")" "401"
+
+check "healthz needs no password" \
 	"$(curl -s -o /dev/null -w '%{http_code}' "http://$addr/healthz")" "200"
 
 check "datastar client is served" \
-	"$(curl -s -o /dev/null -w '%{http_code}' "http://$addr/static/datastar.js")" "200"
+	"$(curl -s -o /dev/null -w '%{http_code}' -u ":$pass" "http://$addr/static/datastar.js")" "200"
 
 check "favicon is served" \
-	"$(curl -s -o /dev/null -w '%{http_code}' "http://$addr/static/favicon.svg")" "200"
+	"$(curl -s -o /dev/null -w '%{http_code}' -u ":$pass" "http://$addr/static/favicon.svg")" "200"
 
 check "theme script is served" \
-	"$(curl -s -o /dev/null -w '%{http_code}' "http://$addr/static/theme.js")" "200"
+	"$(curl -s -o /dev/null -w '%{http_code}' -u ":$pass" "http://$addr/static/theme.js")" "200"
 
-home=$(curl -s "http://$addr/")
+home=$(curl -s -u ":$pass" "http://$addr/")
 check "the header carries the brand" "$home" "Foodster"
 # ENV is unset here, so this instance is production and unmarked.
 check "production tabs are not tagged" "$home" "<title>Foodster</title>"
@@ -84,47 +85,47 @@ check "the theme toggle is present" "$home" "data-theme-toggle"
 check "both theme icons ship so CSS can pick one" "$home" 'class="i-moon"'
 
 check "apple touch icon is served" \
-	"$(curl -s -o /dev/null -w '%{http_code}' "http://$addr/static/apple-touch-icon.png")" "200"
+	"$(curl -s -o /dev/null -w '%{http_code}' -u ":$pass" "http://$addr/static/apple-touch-icon.png")" "200"
 
 # A manifest served as octet-stream is silently ignored by the browser.
 check "manifest has the right content type" \
-	"$(curl -s -o /dev/null -w '%{content_type}' "http://$addr/static/manifest.webmanifest")" \
+	"$(curl -s -o /dev/null -w '%{content_type}' -u ":$pass" "http://$addr/static/manifest.webmanifest")" \
 	"application/manifest+json"
 
 check "catalog starts empty" \
-	"$(curl -s "http://$addr/ruuat")" "0 pääruokaa"
+	"$(curl -s -u ":$pass" "http://$addr/ruuat")" "0 pääruokaa"
 
-out=$(curl -s -F "tiedosto=@seeds/testi.json" "http://$addr/ruuat/tuonti")
+out=$(curl -s -u ":$pass" -F "tiedosto=@seeds/testi.json" "http://$addr/ruuat/tuonti")
 check "file upload imports the seed bundle" "$out" "Lisätty 22, ohitettu 0"
 check "counts update after import" "$out" "16 pääruokaa, 6 lisuketta"
 
 check "re-import refuses duplicates" \
-	"$(curl -s -F "tiedosto=@seeds/testi.json" "http://$addr/ruuat/tuonti")" \
+	"$(curl -s -u ":$pass" -F "tiedosto=@seeds/testi.json" "http://$addr/ruuat/tuonti")" \
 	"jo listalla"
 
 check "pasted JSON imports" \
-	"$(curl -s -F 'json={"mains":[],"sides":[{"name":"Perunasalaatti"}]}' \
+	"$(curl -s -u ":$pass" -F 'json={"mains":[],"sides":[{"name":"Perunasalaatti"}]}' \
 		"http://$addr/ruuat/tuonti")" "Lisätty 1"
 
 check "unknown category is reported" \
-	"$(curl -s -F 'json={"mains":[{"name":"Rikki","categories":["kana"]}],"sides":[]}' \
+	"$(curl -s -u ":$pass" -F 'json={"mains":[{"name":"Rikki","categories":["kana"]}],"sides":[]}' \
 		"http://$addr/ruuat/tuonti")" "tuntematon kategoria"
 
 check "empty submit is explained" \
-	"$(curl -s -F 'json=' "http://$addr/ruuat/tuonti")" "Ei tuotavaa"
+	"$(curl -s -u ":$pass" -F 'json=' "http://$addr/ruuat/tuonti")" "Ei tuotavaa"
 
 check "malformed JSON is explained" \
-	"$(curl -s -F 'json={nope' "http://$addr/ruuat/tuonti")" "JSON ei kelpaa"
+	"$(curl -s -u ":$pass" -F 'json={nope' "http://$addr/ruuat/tuonti")" "JSON ei kelpaa"
 
 # ---- the log flow, against the dishes imported above --------------------
 
-board=$(curl -s "http://$addr/")
+board=$(curl -s -u ":$pass" "http://$addr/")
 check "board lists imported dishes" "$board" "Lihapullat"
 
 # Tähteet is loggable but is not food: on the board, never in the catalog.
 check "leftovers are on the board" "$board" "Tähteet"
 refute "leftovers are not in the catalog" \
-	"$(curl -s "http://$addr/ruuat")" "Tähteet"
+	"$(curl -s -u ":$pass" "http://$addr/ruuat")" "Tähteet"
 
 # Pull a real dish id out of the board rather than assuming one.
 ruoka=$(printf '%s' "$board" | grep -o 'ruoka=[0-9]*' | head -n1 | cut -d= -f2)
@@ -135,147 +136,147 @@ if [ -z "$ruoka" ]; then
 fi
 
 check "picking a dish opens the sides step" \
-	"$(curl -s "http://$addr/?ruoka=$ruoka")" "Tallenna"
+	"$(curl -s -u ":$pass" "http://$addr/?ruoka=$ruoka")" "Tallenna"
 
 check "saving redirects back to the day" \
-	"$(curl -s -o /dev/null -w '%{http_code}' \
+	"$(curl -s -o /dev/null -w '%{http_code}' -u ":$pass" \
 		-d "pvm=$d0&ruoka=$ruoka" "http://$addr/kirjaa")" "303"
 
 check "the saved day shows what was eaten" \
-	"$(curl -s "http://$addr/?pvm=$d0")" "kirjattu"
+	"$(curl -s -u ":$pass" "http://$addr/?pvm=$d0")" "kirjattu"
 
 # The selected day expands inside the list rather than in a panel above it,
 # so the rows below do not shift when one is tapped.
-day=$(curl -s "http://$addr/?pvm=$d0")
+day=$(curl -s -u ":$pass" "http://$addr/?pvm=$d0")
 check "the selected day expands in place" "$day" 'class="open"'
 check "and stays in the list rather than being lifted out" "$day" "kirjattu"
 
 # ---- the day list patches in place instead of navigating ----------------
 
-dayp=$(curl -s -H 'Datastar-Request: true' "http://$addr/paiva?pvm=$d0")
+dayp=$(curl -s -u ":$pass" -H 'Datastar-Request: true' "http://$addr/paiva?pvm=$d0")
 check "opening a day patches the list" "$dayp" 'id="paivat"'
 refute "and returns a fragment, not a page" "$dayp" "<html"
 
 check "picking a dish patches to the sides step" \
-	"$(curl -s -H 'Datastar-Request: true' \
+	"$(curl -s -u ":$pass" -H 'Datastar-Request: true' \
 		"http://$addr/paiva?pvm=$d0&ruoka=$ruoka")" "Tallenna"
 
 check "saving from Datastar patches back" \
-	"$(curl -s -H 'Datastar-Request: true' \
+	"$(curl -s -u ":$pass" -H 'Datastar-Request: true' \
 		-d "pvm=$d1&ruoka=$ruoka" "http://$addr/kirjaa")" 'id="paivat"'
 
 check "deleting from Datastar patches back" \
-	"$(curl -s -H 'Datastar-Request: true' \
+	"$(curl -s -u ":$pass" -H 'Datastar-Request: true' \
 		-d "pvm=$d1" "http://$addr/poista")" 'id="paivat"'
 
 # Without the header it must still redirect, for no JavaScript.
 check "a plain save still redirects to the day" \
-	"$(curl -s -o /dev/null -w '%{redirect_url}' \
+	"$(curl -s -o /dev/null -w '%{redirect_url}' -u ":$pass" \
 		-d "pvm=$d1&ruoka=$ruoka" "http://$addr/kirjaa")" "pvm=$d1"
 
 # Deleting a logged meal drops the row outright, so it asks first.
-saved=$(curl -s "http://$addr/?pvm=$d0&poista=1")
+saved=$(curl -s -u ":$pass" "http://$addr/?pvm=$d0&poista=1")
 check "deleting a meal asks first" "$saved" "Poistetaanko merkintä?"
 # Assert the entry is still shown, rather than that no gap row exists anywhere
 # on the page: other days are legitimately unlogged and render their own.
 check "and the entry is still there while asking" "$saved" "kirjattu"
 
 check "deleting redirects back" \
-	"$(curl -s -o /dev/null -w '%{http_code}' \
+	"$(curl -s -o /dev/null -w '%{http_code}' -u ":$pass" \
 		-d "pvm=$d0" "http://$addr/poista")" "303"
 
 check "the day is empty again" \
-	"$(curl -s "http://$addr/?pvm=$d0")" "Etsi"
+	"$(curl -s -u ":$pass" "http://$addr/?pvm=$d0")" "Etsi"
 
 check "search filters the board" \
-	"$(curl -s "http://$addr/?haku=keitto")" "keitto"
+	"$(curl -s -u ":$pass" "http://$addr/?haku=keitto")" "keitto"
 
 # ---- live search: Datastar sends signals as JSON in ?datastar= -----------
 
-live=$(curl -s --get --data-urlencode 'datastar={"haku":"keitto"}' "http://$addr/etsi")
+live=$(curl -s -u ":$pass" --get --data-urlencode 'datastar={"haku":"keitto"}' "http://$addr/etsi")
 check "live search returns the board fragment" "$live" 'id="lauta"'
 check "live search applies the term" "$live" "keitto"
 refute "live search excludes non-matches" "$live" "Lihapullat"
 refute "the fragment is not a whole page" "$live" "<html"
 
 check "live search is served as html for Datastar to patch" \
-	"$(curl -s -o /dev/null -w '%{content_type}' \
+	"$(curl -s -o /dev/null -w '%{content_type}' -u ":$pass" \
 		--get --data-urlencode 'datastar={"haku":"keitto"}' "http://$addr/etsi")" \
 	"text/html"
 
-cat_live=$(curl -s --get --data-urlencode 'datastar={"haku":"riisi"}' "http://$addr/ruuat/etsi")
+cat_live=$(curl -s -u ":$pass" --get --data-urlencode 'datastar={"haku":"riisi"}' "http://$addr/ruuat/etsi")
 check "catalog live search returns its fragment" "$cat_live" 'id="ruokalista"'
 check "catalog live search matches sides too" "$cat_live" "Riisi"
 refute "catalog live search excludes non-matches" "$cat_live" "Lihapullat"
 
 # The plain form still works without JavaScript.
 check "catalog search works as a plain form too" \
-	"$(curl -s "http://$addr/ruuat?haku=riisi")" "Riisi"
+	"$(curl -s -u ":$pass" "http://$addr/ruuat?haku=riisi")" "Riisi"
 
 # Nothing was eaten tomorrow. A future date is clamped rather than logged.
 future=$(date -d '+30 days' +%Y-%m-%d)
 check "a future date falls back to today" \
-	"$(curl -s "http://$addr/?pvm=$future")" "$(date +%-d.%-m.%Y)"
+	"$(curl -s -u ":$pass" "http://$addr/?pvm=$future")" "$(date +%-d.%-m.%Y)"
 
 check "saving a future date is clamped too" \
-	"$(curl -s -o /dev/null -w '%{redirect_url}' \
+	"$(curl -s -o /dev/null -w '%{redirect_url}' -u ":$pass" \
 		-d "pvm=$future&ruoka=$ruoka" "http://$addr/kirjaa")" "/"
 
 check "tomorrow was not written to the log" \
-	"$(curl -s "http://$addr/?pvm=$future")" "$(date +%-d.%-m.%Y)"
+	"$(curl -s -u ":$pass" "http://$addr/?pvm=$future")" "$(date +%-d.%-m.%Y)"
 
 # Clean up the entry that clamped onto today.
-curl -s -o /dev/null -d "pvm=$(date +%Y-%m-%d)" "http://$addr/poista"
+curl -s -o /dev/null -u ":$pass" -d "pvm=$(date +%Y-%m-%d)" "http://$addr/poista"
 
 # ---- adding a dish without leaving Kirjaa --------------------------------
 
-miss=$(curl -s "http://$addr/?haku=Poronkariste")
+miss=$(curl -s -u ":$pass" "http://$addr/?haku=Poronkariste")
 check "a search with no hits offers to add it" "$miss" "Ei osumia. Lisätäänkö?"
 check "the add form is prefilled with the search" "$miss" 'value="Poronkariste"'
 
 check "quick add goes straight to the sides step" \
-	"$(curl -s -o /dev/null -w '%{redirect_url}' \
+	"$(curl -s -o /dev/null -w '%{redirect_url}' -u ":$pass" \
 		-d 'nimi=Poronkariste&kategoria=meat&lisukkeita=1' "http://$addr/lisaa")" \
 	"ruoka="
 
 check "quick add rejects a dish with no category" \
-	"$(curl -s -d 'nimi=Kategoriaton' "http://$addr/lisaa")" \
+	"$(curl -s -u ":$pass" -d 'nimi=Kategoriaton' "http://$addr/lisaa")" \
 	"Valitse vähintään yksi kategoria."
 
 check "the quick-added dish is on the board" \
-	"$(curl -s "http://$addr/")" "Poronkariste"
+	"$(curl -s -u ":$pass" "http://$addr/")" "Poronkariste"
 
 # ---- catalog CRUD from the UI -------------------------------------------
 
 # Assert where it redirects, not just that it does: these pointed at the old
 # /ruoat spelling for a while and every 303-only check was happy.
 check "adding a main redirects back to the catalog" \
-	"$(curl -s -o /dev/null -w '%{redirect_url}' \
+	"$(curl -s -o /dev/null -w '%{redirect_url}' -u ":$pass" \
 		-d 'nimi=uunikala&kategoria=fish&lisukkeita=1' "http://$addr/ruuat/paaruoka")" \
 	"/ruuat"
 
-catalog=$(curl -s "http://$addr/ruuat")
+catalog=$(curl -s -u ":$pass" "http://$addr/ruuat")
 check "the new main is listed, sentence-cased" "$catalog" "Uunikala"
 
 check "a duplicate name is refused" \
-	"$(curl -s -d 'nimi=UUNIKALA&kategoria=fish' "http://$addr/ruuat/paaruoka")" \
+	"$(curl -s -u ":$pass" -d 'nimi=UUNIKALA&kategoria=fish' "http://$addr/ruuat/paaruoka")" \
 	"Nimi on jo listalla."
 
 check "a main with no category is refused" \
-	"$(curl -s -d 'nimi=Kategoriaton' "http://$addr/ruuat/paaruoka")" \
+	"$(curl -s -u ":$pass" -d 'nimi=Kategoriaton' "http://$addr/ruuat/paaruoka")" \
 	"Valitse vähintään yksi kategoria."
 
 check "a nameless dish is refused" \
-	"$(curl -s -d 'nimi=+++&kategoria=fish' "http://$addr/ruuat/paaruoka")" \
+	"$(curl -s -u ":$pass" -d 'nimi=+++&kategoria=fish' "http://$addr/ruuat/paaruoka")" \
 	"Anna nimi."
 
 check "adding a side redirects back to the catalog" \
-	"$(curl -s -o /dev/null -w '%{redirect_url}' \
+	"$(curl -s -o /dev/null -w '%{redirect_url}' -u ":$pass" \
 		-d 'nimi=lohkoperunat' "http://$addr/ruuat/lisuke")" \
 	"/ruuat"
 
 check "the new side is listed" \
-	"$(curl -s "http://$addr/ruuat")" "Lohkoperunat"
+	"$(curl -s -u ":$pass" "http://$addr/ruuat")" "Lohkoperunat"
 
 # The id of Uunikala specifically: the catalog is grouped and alphabetical, so
 # the first id on the page belongs to some other dish entirely.
@@ -286,20 +287,20 @@ if [ -z "$uusi" ]; then
 	uusi=0
 fi
 check "the edit form is prefilled" \
-	"$(curl -s "http://$addr/ruuat?muokkaa=$uusi")" "Muokkaa pääruokaa"
+	"$(curl -s -u ":$pass" "http://$addr/ruuat?muokkaa=$uusi")" "Muokkaa pääruokaa"
 
 # A bin icon is easy to hit by accident, so the row asks before anything goes.
 check "the bin asks before deleting" \
-	"$(curl -s "http://$addr/ruuat?poista=$uusi&tyyppi=paa")" "Poista?"
+	"$(curl -s -u ":$pass" "http://$addr/ruuat?poista=$uusi&tyyppi=paa")" "Poista?"
 
 check "the dish is still there while it asks" \
-	"$(curl -s "http://$addr/ruuat?poista=$uusi&tyyppi=paa")" "Uunikala"
+	"$(curl -s -u ":$pass" "http://$addr/ruuat?poista=$uusi&tyyppi=paa")" "Uunikala"
 
 # ---- the catalog patches in place instead of navigating -----------------
 
 # A delete confirmation halfway down a long list must not send the browser
 # back to the top, so these answer with a Datastar patch rather than a page.
-patch=$(curl -s -H 'Datastar-Request: true' \
+patch=$(curl -s -u ":$pass" -H 'Datastar-Request: true' \
 	"http://$addr/ruuat/nayta?poista=$uusi&tyyppi=paa")
 check "asking to delete patches rather than navigates" "$patch" "event: datastar-patch-elements"
 check "the patch carries the list" "$patch" 'id="ruokalista"'
@@ -307,26 +308,26 @@ check "and both forms, so an open one closes" "$patch" 'id="paaruoka"'
 check "the row it patches in is asking" "$patch" "Poista?"
 
 check "patches are served as an event stream" \
-	"$(curl -s -o /dev/null -w '%{content_type}' -H 'Datastar-Request: true' \
+	"$(curl -s -o /dev/null -w '%{content_type}' -u ":$pass" -H 'Datastar-Request: true' \
 		"http://$addr/ruuat/nayta")" "text/event-stream"
 
 check "deleting from Datastar patches too" \
-	"$(curl -s -H 'Datastar-Request: true' \
+	"$(curl -s -u ":$pass" -H 'Datastar-Request: true' \
 		-d "id=$uusi&tyyppi=paa" "http://$addr/ruuat/poista")" \
 	"event: datastar-patch-elements"
 
 refute "and the dish is gone from the patched list" \
-	"$(curl -s -H 'Datastar-Request: true' "http://$addr/ruuat/nayta")" \
+	"$(curl -s -u ":$pass" -H 'Datastar-Request: true' "http://$addr/ruuat/nayta")" \
 	"Uunikala"
 
 # Without the header it must still be an ordinary redirect, for no JavaScript.
 check "a plain form post still redirects" \
-	"$(curl -s -o /dev/null -w '%{redirect_url}' \
+	"$(curl -s -o /dev/null -w '%{redirect_url}' -u ":$pass" \
 		-d 'nimi=Testiruoka&kategoria=fish' "http://$addr/ruuat/paaruoka")" \
 	"/ruuat"
 
 refute "the dish is gone once confirmed" \
-	"$(curl -s "http://$addr/ruuat")" "Uunikala"
+	"$(curl -s -u ":$pass" "http://$addr/ruuat")" "Uunikala"
 
 if [ "$fail" -ne 0 ]; then
 	echo "smoke: FAILED"