Function BearerAuthMiddleware

pkg/mcp/middleware.go:26–38

BearerAuthMiddleware returns an http.Handler that enforces bearer token authentication when cfg.AuthEnabled() is true. When auth is disabled it passes all requests through unchanged. On failure it responds 401 with a WWW-Authenticate header.

(cfg *Config, next http.Handler)

// passes all requests through unchanged. On failure it responds 401 with a
// WWW-Authenticate header.
func BearerAuthMiddleware(cfg *Config, next http.Handler) http.Handler {
	if !cfg.AuthEnabled() {
		return next
	}
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if extractBearerToken(r) != cfg.AuthToken {
			w.Header().Set("WWW-Authenticate", `Bearer realm="gosqlx-mcp"`)
			http.Error(w, "Unauthorized", http.StatusUnauthorized)
			return
		}
		next.ServeHTTP(w, r)
	})
}

// extractBearerToken parses the "Authorization: Bearer <token>" header.
// Returns an empty string if the header is absent or malformed.