Function requireCriticalConfigAuth

server/http_auth.go:246–258

requireCriticalConfigAuth guards script-plugin configs: API key passes; session users must supply the admin password.

(w http.ResponseWriter, r *http.Request, authObject auth.Auth, req configReq)

// requireCriticalConfigAuth guards script-plugin configs: API key passes; session users must supply the admin password.
func requireCriticalConfigAuth(w http.ResponseWriter, r *http.Request, authObject auth.Auth, req configReq) bool {
	if authObject.GetAuthMode() == auth.Disabled || !configHasCriticalPlugin(req) {
		return true
	}
	if key := apiKeyFromRequest(r); key != "" && authObject.ValidateApiKey(key) {
		return true
	}
	if !authObject.IsAdminPasswordValid(r.Header.Get("X-Admin-Password")) {
		jsonError(w, http.StatusPreconditionRequired, errors.New("admin password required"))
		return false
	}
	return true
}

// ensureDbAuth guards /db/ endpoints: API key Bearer passes directly;
// session users must also supply the admin password in X-Admin-Password header.