From 70d2669e68f78ad640131dd7ffbbed73b361ea23 Mon Sep 17 00:00:00 2001
From: mrcanelas <sialsan@hotmail.com>
Date: Sun, 13 Apr 2025 16:26:16 -0300
Subject: [PATCH] feat(security): add authentication to Swagger Stats UI

- feat(security): implement basic auth for /stats/ui endpoint
- feat(security): add METRICS_USER and METRICS_PASSWORD env variables

This change adds a layer of security to the metrics dashboard,
requiring authentication to access the Swagger Stats UI.
---
 addon/utils/analytics.js | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/addon/utils/analytics.js b/addon/utils/analytics.js
index 96af728..96fe5ff 100644
--- a/addon/utils/analytics.js
+++ b/addon/utils/analytics.js
@@ -17,15 +17,15 @@ class Analytics {
             }
 
             this.middleware = swaggerStats.getMiddleware({
-                name: 'TMDB Addon',
-                version: '3.1.3',
+                name: packageJson.name,
+                version: packageJson.version,
                 timelineBucketDuration: 60000,
                 uriPath: '/stats/ui',
-                authentication: false,
+                authentication: true,
                 onAuthenticate: (req, username, password) => {
-                    return true;
+                  return username === process.env.METRICS_USER
+                      && password === process.env.METRICS_PASSWORD
                 },
-                elasticsearch: false,
                 mongodb: {
                     uri: mongodbUri,
                     collectionPrefix: 'stats_'
@@ -33,7 +33,7 @@ class Analytics {
                 swaggerSpec: {
                     info: {
                         title: 'TMDB Addon API',
-                        version: '3.1.3'
+                        version: packageJson.version
                     }
                 }
             });