Merge remote-tracking branch 'origin/260201-readonly' into beta

# Conflicts:
#	README.md
#	www/index.html

internal/streams/api.go

@@ -12,6 +12,13 @@ import (
 
 func apiStreams(w http.ResponseWriter, r *http.Request) {
 	w = creds.SecretResponse(w)
+	if api.IsReadOnly() {
+		switch r.Method {
+		case "PUT", "PATCH", "POST", "DELETE":
+			api.ReadOnlyError(w)
+			return
+		}
+	}
 
 	query := r.URL.Query()
 	src := query.Get("src")
@@ -130,6 +137,13 @@ func apiStreamsDOT(w http.ResponseWriter, r *http.Request) {
 }
 
 func apiPreload(w http.ResponseWriter, r *http.Request) {
+	if api.IsReadOnly() {
+		switch r.Method {
+		case "PUT", "DELETE":
+			api.ReadOnlyError(w)
+			return
+		}
+	}
 	// GET - return all preloads
 	if r.Method == "GET" {
 		api.ResponseJSON(w, GetPreloads())

internal/streams/api_readonly_test.go

@@ -0,0 +1,68 @@
+package streams
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/AlexxIT/go2rtc/internal/api"
+	"github.com/stretchr/testify/require"
+)
+
+func TestApiStreamsReadOnly(t *testing.T) {
+	prevReadOnly := api.ReadOnly
+	t.Cleanup(func() {
+		api.ReadOnly = prevReadOnly
+	})
+
+	api.ReadOnly = true
+
+	for _, method := range []string{"PUT", "PATCH", "POST", "DELETE"} {
+		t.Run(method, func(t *testing.T) {
+			req := httptest.NewRequest(method, "/api/streams?src=test", nil)
+			w := httptest.NewRecorder()
+
+			apiStreams(w, req)
+
+			require.Equal(t, http.StatusForbidden, w.Code)
+		})
+	}
+
+	t.Run("GET allowed", func(t *testing.T) {
+		req := httptest.NewRequest("GET", "/api/streams", nil)
+		w := httptest.NewRecorder()
+
+		apiStreams(w, req)
+
+		require.Equal(t, http.StatusOK, w.Code)
+	})
+}
+
+func TestApiPreloadReadOnly(t *testing.T) {
+	prevReadOnly := api.ReadOnly
+	t.Cleanup(func() {
+		api.ReadOnly = prevReadOnly
+	})
+
+	api.ReadOnly = true
+
+	for _, method := range []string{"PUT", "DELETE"} {
+		t.Run(method, func(t *testing.T) {
+			req := httptest.NewRequest(method, "/api/preload?src=test", nil)
+			w := httptest.NewRecorder()
+
+			apiPreload(w, req)
+
+			require.Equal(t, http.StatusForbidden, w.Code)
+		})
+	}
+
+	t.Run("GET allowed", func(t *testing.T) {
+		req := httptest.NewRequest("GET", "/api/preload", nil)
+		w := httptest.NewRecorder()
+
+		apiPreload(w, req)
+
+		require.Equal(t, http.StatusOK, w.Code)
+	})
+}