agent endpoints now protected

drone.go

@@ -115,6 +115,7 @@ func main() {
 
 	queue := api.Group("/queue")
 	{
+		queue.Use(server.MustAgent())
 		queue.GET("", server.GetQueue)
 		queue.POST("/pull", server.PollBuild)
 

server/agent.go

@@ -9,6 +9,8 @@ import (
 func GetAgentToken(c *gin.Context) {
 	sess := ToSession(c)
 	token := &common.Token{}
+	token.Kind = common.TokenAgent
+	token.Label = "drone-agent"
 	tokenstr, err := sess.GenerateToken(token)
 	if err != nil {
 		c.Fail(500, err)

server/server.go

@@ -213,6 +213,21 @@ func MustAdmin() gin.HandlerFunc {
 	}
 }
 
+func MustAgent() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		sess := ToSession(c)
+		token := sess.GetLogin(c.Request)
+		if token == nil {
+			c.AbortWithStatus(401)
+			return
+		} else if token.Kind != common.TokenAgent {
+			c.AbortWithStatus(500)
+			return
+		}
+		c.Next()
+	}
+}
+
 func CheckPull() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		u := ToUser(c)