Function isExemptPath

core/http/auth/middleware.go:550–575

isExemptPath returns true if the path should skip authentication.

(path string, appConfig *config.ApplicationConfig)

// isExemptPath returns true if the path should skip authentication.
func isExemptPath(path string, appConfig *config.ApplicationConfig) bool {
	// Auth endpoints are always public
	if strings.HasPrefix(path, "/api/auth/") {
		return true
	}

	// Node self-service endpoints — authenticated via registration token, not global auth.
	// Only exempt the specific known endpoints, not the entire prefix.
	if strings.HasPrefix(path, "/api/node/") {
		if path == "/api/node/register" ||
			strings.HasSuffix(path, "/heartbeat") ||
			strings.HasSuffix(path, "/drain") ||
			strings.HasSuffix(path, "/deregister") {
			return true
		}
	}

	// Check configured exempt paths
	for _, p := range appConfig.PathWithoutAuth {
		if strings.HasPrefix(path, p) {
			return true
		}
	}

	return false
}

// isAPIPath returns true for paths that always require authentication.
func isAPIPath(path string) bool {