weichenandCursor
92d7a3d117
Expose GET /api/v1/vault/status and only wire in-process Drain when FAV_PUBLISHER_ENABLED is explicitly true; degraded read stays off by default. Co-authored-by: Cursor <cursoragent@cursor.com>
66 lines
1.5 KiB
Go
66 lines
1.5 KiB
Go
package server
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
)
|
|
|
|
func (s *Server) allowLegacyTestPrincipal() bool {
|
|
if s.cfg == nil {
|
|
return false
|
|
}
|
|
env := s.cfg.Env
|
|
if env != "dev" && env != "test" && env != "" {
|
|
return false
|
|
}
|
|
return s.cfg.AllowInMemory && s.cfg.ContextDbHost == ""
|
|
}
|
|
|
|
func isPublicRoute(method, path string) bool {
|
|
if path == "/" || path == "/health" || path == "/api/v1/health" ||
|
|
path == "/ready" || path == "/api/v1/ready" ||
|
|
path == "/api/v1/vault/status" {
|
|
return true
|
|
}
|
|
if method == http.MethodPost && path == "/api/v1/auth/login" {
|
|
return true
|
|
}
|
|
if method == http.MethodPost && path == "/api/v1/auth/register" {
|
|
return true
|
|
}
|
|
if method == http.MethodGet && path == "/api/v1/auth/public-config" {
|
|
return true
|
|
}
|
|
if !strings.HasPrefix(path, "/api/") {
|
|
return true
|
|
}
|
|
return false
|
|
}
|
|
|
|
func (s *Server) authMiddleware(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
path := r.URL.Path
|
|
if isPublicRoute(r.Method, path) {
|
|
next.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
|
|
user, err := s.authenticateUser(r)
|
|
if (err != nil || user == nil) && s.allowLegacyTestPrincipal() {
|
|
if fallback, fbErr := s.authSvc.GetUserByID(r.Context(), 1); fbErr == nil && fallback != nil {
|
|
user = fallback
|
|
}
|
|
}
|
|
if user == nil {
|
|
writeJSONResponse(w, http.StatusUnauthorized, map[string]string{
|
|
"error_code": "ERR_UNAUTHENTICATED",
|
|
"message": "请先登录",
|
|
})
|
|
return
|
|
}
|
|
|
|
ctx := withPrincipal(r.Context(), user)
|
|
next.ServeHTTP(w, r.WithContext(ctx))
|
|
})
|
|
}
|