allow command auth disable via API_TOKEN_DISABLE

README.md

@@ -104,6 +104,7 @@ Basically the same environment variables for the database, mqqt and timezone nee
 - **TESLAMATE_HOST** string *(default: teslamate)*
 - **TESLAMATE_PORT** string *(default: 4000)*
 - **API_TOKEN** string *(default: )*
+- **API_TOKEN_DISABLE** string *(default: false)*
 - **DATABASE_PORT** integer *(default: 5432)*
 - **DATABASE_TIMEOUT** integer *(default: 60000)*
 - **DATABASE_SSL** boolean *(default: true)*
@@ -204,6 +205,8 @@ The data that is accessible is data like the cars, charges, drives, current stat
 
 Also, apply some authentication on your webserver in front of the container, so your data is not unprotected and too exposed. In the example above, we use the same .htpasswd file as used by TeslaMate.
 
+If you have applied a level of authentication in front of the container `API_TOKEN_DISABLE=true` will allow commands without requiring the header or uri token value.
+
 ## Credits
 
 - Authors: Tobias Lindberg – [List of contributors](https://github.com/tobiasehlert/teslamateapi/graphs/contributors)

src/AuthSupport.go

@@ -23,6 +23,12 @@ func initAuthToken() {
 // validateAuthToken func
 func validateAuthToken(c *gin.Context) (bool, string) {
 
+	// if API_TOKEN_DISABLE is true, skip token validation.
+	if getEnvAsBool("API_TOKEN_DISABLE", false) == true {
+		log.Println("[debug] validateAuthToken - header authorization bearer token disabled.")
+		return true, ""
+	}
+
 	// trying with http header - Authorization: Bearer <token>
 	reqHeaderToken := c.Request.Header.Get("Authorization")
 

src/webserver.go

@@ -58,6 +58,10 @@ func main() {
 		log.Fatalf("[error] TeslaMateApi MQTT connection failed: %s", err)
 	}
 
+	if getEnvAsBool("API_TOKEN_DISABLE", false) == true {
+		log.Println("[warning] validateAuthToken - header authorization bearer token disabled. Authorizaiton: Bearer token will not be required for commands.")
+	}
+
 	// kicking off Gin in value r
 	r := gin.Default()