feat: add basic auth util and middleware

[cjpearson]

Resolves #551

Port of #826 to the main (v2) branch

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 83.41%. Comparing base (a58d7c9) to head (68125da).
Report is 225 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #998      +/-   ##
==========================================
+ Coverage   77.83%   83.41%   +5.58%     
==========================================
  Files          47       36      -11     
  Lines        4286     2647    -1639     
  Branches      611      681      +70     
==========================================
- Hits         3336     2208    -1128     
+ Misses        933      437     -496     
+ Partials       17        2      -15     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[pi0]

I think it would be better if we expose a requireBasicAuth utility that can be used to make a middleware (in defineEventHandler({ before }), used on demand or as wrapper.

H3 utils tend to be explicit for usage (called exactly where they need to)

[cjpearson]

Yeah I can rework this. To confirm my understanding, is this the API you're expecting?

defineEventHandler({
  onBeforeResponse: (event) => requireBasicAuth(event, {username: 'hello', password: 'world' }),
  handler: (_event) => {
    return { message: "⚡️ Tadaa!" };
  }
})

defineEventHandler((event) => {
  requireBasicAuth(event, {username: 'hello', password: 'world' })
  return { message: "⚡️ Tadaa!" };
})

In this scenario, requireBasicAuth would have to throw an H3Error in case of authentication failure, right? Or should it return Response | undefined and expect the handler which called it to take care of sending the response?

[codecov]

Codecov Report

Attention: Patch coverage is 84.21053% with 9 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/utils/auth.ts	83.67%	8 Missing ⚠️
src/response.ts	83.33%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[pi0]

Thanks for the initial work on this! I updated PR with requireBasicAuth + basicAuth (with new middleware) to reuse.