From 1f03123f2edc3f7a93e993cde090f76a7baf2b12 Mon Sep 17 00:00:00 2001
From: Rene Evertz <rene.evertz@ownsoft.de>
Date: Fri, 21 Feb 2025 11:56:47 +0100
Subject: [PATCH] API Key hinterlegt

---
 Host/Web.config                                     |  2 ++
 .../ServiceBehavior/AdminServiceMessageInspector.cs | 13 +++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/Host/Web.config b/Host/Web.config
index f513048a7..b183fe83f 100644
--- a/Host/Web.config
+++ b/Host/Web.config
@@ -248,6 +248,8 @@
   <!-- <> <> <>  Appsettings <> <> <> -->
   <appSettings>
     <add key="AdminServiceIPAddress" value="::1" />
+    <add key="AdminServiceAPIKey" value="HasteGedachteWa" />    
+    
     <add key="SendMailOnError" value="false" />
     <add key="SmptServer" value="mail.ownsoft.de" />
     <add key="SmtpUser" value="bewoplaner.support@ownsoft.de" />
diff --git a/Service/ServiceBehavior/AdminServiceMessageInspector.cs b/Service/ServiceBehavior/AdminServiceMessageInspector.cs
index 592a032b5..58c4f196b 100644
--- a/Service/ServiceBehavior/AdminServiceMessageInspector.cs
+++ b/Service/ServiceBehavior/AdminServiceMessageInspector.cs
@@ -29,6 +29,19 @@ namespace BeWo.Service.ServiceBehavior
 				throw new UnauthorizedAccessException($"Zugriff verweigert. Remote IP ({remoteIP ?? "Unbekannt"}) ist nicht erlaubt.");
 			}
 
+			// Hole erlaubten API Key aus den appSettings
+			string allowedApikey = ConfigurationManager.AppSettings["AdminServiceIPAddress"];
+
+			// Extrahiert den API Key von Remote
+			var prop = (HttpRequestMessageProperty)request.Properties[HttpRequestMessageProperty.Name];
+			var remoteApikey = prop?.Headers["AdminServiceAPIKey"];
+
+			// Vergleicht die API Keys
+			if(remoteApikey == null || !string.Equals(remoteApikey, allowedApikey, StringComparison.Ordinal))
+			{
+				throw new UnauthorizedAccessException($"Zugriff verweigert. API Key ({remoteApikey ?? "Unbekannt"}) ist nicht erlaubt.");
+			}
+
 			return null; // Keine Zustandsinformationen erforderlich
 		}