From f9297b68e3e51acd90f580d37f442fdffa164227 Mon Sep 17 00:00:00 2001
From: Aaron <aaron@pikit.local>
Date: Wed, 10 Dec 2025 19:51:23 -0500
Subject: [PATCH] Support auth token for manifest/bundle downloads

---
 pikit-api.py | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pikit-api.py b/pikit-api.py
index 943d846..9f5c932 100644
--- a/pikit-api.py
+++ b/pikit-api.py
@@ -40,6 +40,7 @@ DEFAULT_MANIFEST_URL = os.environ.get(
     "PIKIT_MANIFEST_URL",
     "https://git.44r0n.cc/44r0n7/pi-kit/releases/latest/download/manifest.json",
 )
+AUTH_TOKEN = os.environ.get("PIKIT_AUTH_TOKEN")
 WEB_ROOT = pathlib.Path("/var/www/pikit-web")
 API_PATH = pathlib.Path("/usr/local/bin/pikit-api.py")
 BACKUP_ROOT = pathlib.Path("/var/backups/pikit")
@@ -526,7 +527,10 @@ def save_update_state(state: dict):
 
 def fetch_manifest(url: str = None):
     target = url or DEFAULT_MANIFEST_URL
-    resp = urllib.request.urlopen(target, timeout=10)
+    req = urllib.request.Request(target)
+    if AUTH_TOKEN:
+        req.add_header("Authorization", f"token {AUTH_TOKEN}")
+    resp = urllib.request.urlopen(req, timeout=10)
     data = resp.read()
     manifest = json.loads(data.decode())
     return manifest
@@ -534,7 +538,10 @@ def fetch_manifest(url: str = None):
 
 def download_file(url: str, dest: pathlib.Path):
     ensure_dir(dest.parent)
-    with urllib.request.urlopen(url, timeout=30) as resp, dest.open("wb") as f:
+    req = urllib.request.Request(url)
+    if AUTH_TOKEN:
+        req.add_header("Authorization", f"token {AUTH_TOKEN}")
+    with urllib.request.urlopen(req, timeout=60) as resp, dest.open("wb") as f:
         shutil.copyfileobj(resp, f)
     return dest