add a simple auth function

Signed-off-by: GnomeZworc <nicolas.boufidjeline@g3e.fr>

internal/api/handler_test.go

@@ -42,6 +42,7 @@ func newTestServer(t *testing.T) (*httptest.Server, *sql.DB) {
 		api.NewSyncHandler(syncSvc),
 		api.NewSnapshotHandler(snapshotSvc),
 		api.NewProxyHandler(repoSvc, dataDir),
+		true,
 	)
 
 	srv := httptest.NewServer(router)
@@ -77,6 +78,31 @@ func decodeJSON(t *testing.T, resp *http.Response, v any) {
 	}
 }
 
+// --- Auth ---
+
+func TestAuth_allowsNonLocalhost(t *testing.T) {
+	srv, _ := newTestServer(t)
+
+	// Non-localhost callers are currently allowed — localhost is privileged, not exclusive.
+	router := srv.Config.Handler
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest(http.MethodGet, "/api/v1/repos", nil)
+	req.RemoteAddr = "203.0.113.1:12345"
+	router.ServeHTTP(w, req)
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200 for non-localhost (no token system yet), got %d", w.Code)
+	}
+}
+
+func TestAuth_allowsLocalhost(t *testing.T) {
+	srv, _ := newTestServer(t)
+	resp := do(t, http.MethodGet, srv.URL+"/api/v1/repos", nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Errorf("expected 200 from localhost, got %d", resp.StatusCode)
+	}
+	resp.Body.Close()
+}
+
 // --- Health ---
 
 func TestHealth(t *testing.T) {