Fixed API calls authorized with HTTP header

Only reqBasicAuth is modified to allow reverse proxy
auth as alternative and reqToken is left untouched.

Fixes: dc952c0
Author-Change-Id: IB#1107572

routers/api/v1/api.go

@@ -21,7 +21,7 @@
 //     - text/html
 //
 //     Security:
-//     - BasicAuth :
+//     - BasicOrReverseProxyAuth :
 //     - Token :
 //     - AccessToken :
 //     - AuthorizationHeaderToken :
@@ -30,8 +30,9 @@
 //     - TOTPHeader :
 //
 //     SecurityDefinitions:
-//     BasicAuth:
-//          type: basic
+//     BasicOrReverseProxyAuth:
+//          type: basicOrReverseProxy
+//          description: Basic auth or rexerse proxy auth using HTTP header.
 //     Token:
 //          type: apiKey
 //          name: token
@@ -59,7 +60,7 @@
 //          type: apiKey
 //          name: X-GITEA-OTP
 //          in: header
-//          description: Must be used in combination with BasicAuth if two-factor authentication is enabled.
+//          description: Must be used in combination with BasicOrReverseProxyAuth if two-factor authentication is enabled.
 //
 // swagger:meta
 package v1
@@ -197,21 +198,20 @@ func reqToken() func(ctx *context.APIContext) {
 			return
 		}
 		if ctx.IsSigned {
-			// Don't require token if already authenticated by reverse proxy.
-			if setting.Service.EnableReverseProxyAuth {
-				return
-			}
 			ctx.RequireCSRF()
 			return
 		}
 		ctx.Error(http.StatusUnauthorized, "reqToken", "token is required")
 	}
 }
 
-func reqBasicAuth() func(ctx *context.APIContext) {
+func reqBasicOrRevProxyAuth() func(ctx *context.APIContext) {
 	return func(ctx *context.APIContext) {
+		if ctx.IsSigned && setting.Service.EnableReverseProxyAuth {
+			return
+		}
 		if !ctx.Context.IsBasicAuth {
-			ctx.Error(http.StatusUnauthorized, "reqBasicAuth", "basic auth required")
+			ctx.Error(http.StatusUnauthorized, "reqBasicOrRevProxyAuth", "auth required")
 			return
 		}
 		ctx.CheckForOTP()
@@ -611,7 +611,7 @@ func Routes() *web.Route {
 					m.Combo("").Get(user.ListAccessTokens).
 						Post(bind(api.CreateAccessTokenOption{}), user.CreateAccessToken)
 					m.Combo("/{id}").Delete(user.DeleteAccessToken)
-				}, reqBasicAuth())
+				}, reqBasicOrRevProxyAuth())
 			})
 		})