Method requireAuth

apps/server/internal/httpserver/server.go:229–254

(next http.Handler)

}

func (s *Server) requireAuth(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		cfg := s.currentConfig()
		expected := strings.TrimSpace(cfg.AuthToken)
		if expected == "" {
			next.ServeHTTP(w, r)
			return
		}

		provided := strings.TrimSpace(strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer "))
		if subtleCompare(provided, expected) || s.requestAuthenticatedViaSession(r) {
			next.ServeHTTP(w, r)
			return
		}

		if strings.HasSuffix(r.URL.Path, "/watch") || r.URL.Path == "/watch" {
			if !s.wsRejectLimiter.allow(s.clientAddressKey(r)) {
				http.Error(w, "too many unauthorized websocket attempts", http.StatusTooManyRequests)
				return
			}
		}

		w.Header().Set("WWW-Authenticate", `Bearer realm="ZenNotes"`)
		http.Error(w, "unauthorized", http.StatusUnauthorized)
	})
}

// --- Responses ---