Function MetricsAuthHandler

api/middleware/middleware.go:120–154

MetricsAuthHandler wraps an http.Handler with bearer token authentication. This is the non-Gin equivalent of MetricsAuth, used for the worker monitoring server which uses a standard http.ServeMux instead of Gin. Same secure mode logic as MetricsAuth: blocks access when secure=true and token is empty

(secure bool, token string, next http.Handler)

// which uses a standard http.ServeMux instead of Gin.
// Same secure mode logic as MetricsAuth: blocks access when secure=true and token is empty.
func MetricsAuthHandler(secure bool, token string, next http.Handler) http.Handler {
	if secure && token == "" {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			w.Header().Set("Content-Type", "application/json")
			w.WriteHeader(http.StatusForbidden)
			_, _ = w.Write([]byte(`{"error":"Metrics endpoint unavailable: metrics_bearer_token must be configured when secure mode is enabled"}`))
		})
	}

	if token == "" {
		return next
	}

	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		auth := r.Header.Get("Authorization")
		if auth == "" {
			http.Error(w, `{"error":"Authorization required for metrics endpoint"}`, http.StatusUnauthorized)
			return
		}

		const prefix = "Bearer "
		if !strings.HasPrefix(auth, prefix) {
			http.Error(w, `{"error":"Authorization header must use Bearer scheme"}`, http.StatusUnauthorized)
			return
		}

		provided := auth[len(prefix):]
		if subtle.ConstantTimeCompare([]byte(provided), []byte(token)) != 1 {
			http.Error(w, `{"error":"Invalid bearer token"}`, http.StatusUnauthorized)
			return
		}

		next.ServeHTTP(w, r)
	})
}

// SecurityHeaders sets security headers to the response.
// It sets the following headers: