Repository: influxdata/influxdb
File: influxdb3_server/src/http.rs (Rust)

Code before:
    // for people wanting to query the DB directly from a browser rather
    // than from a server. We're permissive about what works with CORS
    // so we don't need to check the incoming request, just respond with
    // the following headers. We do this before the API token checks as
    // the browser will not send a request with an auth header for CORS.
    if let Method::OPTIONS = method {
        info!(?uri, "preflight request");
        return Ok(Response::builder()
            .header("Access-Control-Allow-Origin", "*")
            .header("Access-Control-Allow-Methods", "*")
            .header("Access-Control-Allow-Headers", "*")
            .header("Access-Control-Max-Age", "86400")
            .status(204)
            .body(Body::empty())
            .expect("Able to always create a valid response type for CORS"));
    }

    if started_without_auth && uri.path().starts_with(all_paths::API_V3_CONFIGURE_TOKEN) {
        return Ok(Response::builder()
            .status(StatusCode::METHOD_NOT_ALLOWED)
            .body("endpoint disabled, started without auth".into())
            .unwrap());
    }

    let path = uri.path();
    // admin token creation should be allowed without authentication
    // and any endpoints that are disabled
    if path == all_paths::API_V3_CONFIGURE_ADMIN_TOKEN
        || paths_without_authz
            .iter()
            .any(|disabled_authz_path| *disabled_authz_path == path)
    {
        trace!(?uri, "not authenticating request");
    } else {
        trace!(?uri, "authenticating request");
        if let Some(authentication_error) = authenticate(&http_server, &mut req).await {
            return authentication_error;
        }
    }

    trace!(request = ?req,"Processing request");
    let content_length = req.headers().get("content-length").cloned();

    let response = match (method.clone(), path) {
        (Method::DELETE, all_paths::API_V3_CONFIGURE_TOKEN) => http_server.delete_token(req).await,
        (Method::POST, all_paths::API_V3_CONFIGURE_ADMIN_TOKEN) => {
            http_server.create_admin_token(req).await
        }
        (Method::POST, all_paths::API_V3_CONFIGURE_ADMIN_TOKEN_REGENERATE) => {
            http_server.regenerate_admin_token(req).await
        }

Review comment (performance):
clippy suggested that `contains` was more efficient than `iter().any()`, which makes sense.

Code after:
    // so we don't need to check the incoming request, just respond with
    // the following headers. We do this before the API token checks as
    // the browser will not send a request with an auth header for CORS.
    if let Method::OPTIONS = method {
        info!(?uri, "preflight request");
        return Ok(Response::builder()
            .header("Access-Control-Allow-Origin", "*")
            .header("Access-Control-Allow-Methods", "*")
            .header("Access-Control-Allow-Headers", "*")
            .header("Access-Control-Max-Age", "86400")
            .status(204)
            .body(Body::empty())
            .expect("Able to always create a valid response type for CORS"));
    }

    if started_without_auth && uri.path().starts_with(all_paths::API_V3_CONFIGURE_TOKEN) {
        return Ok(Response::builder()
            .status(StatusCode::METHOD_NOT_ALLOWED)
            .body("endpoint disabled, started without auth".into())
            .unwrap());
    }

    let path = uri.path();
    // admin token creation should be allowed without authentication
    // and any endpoints that are disabled
    if path == all_paths::API_V3_CONFIGURE_ADMIN_TOKEN || paths_without_authz.contains(&path) {
        trace!(?uri, "not authenticating request");
    } else {
        trace!(?uri, "authenticating request");
        if let Some(authentication_error) = authenticate(&http_server, &mut req).await {
            return authentication_error;
        }
    }

    trace!(request = ?req,"Processing request");
    let content_length = req.headers().get("content-length").cloned();

    let response = match (method.clone(), path) {
        (Method::DELETE, all_paths::API_V3_CONFIGURE_TOKEN) => http_server.delete_token(req).await,
        (Method::POST, all_paths::API_V3_CONFIGURE_ADMIN_TOKEN) => {
            http_server.create_admin_token(req).await
        }
        (Method::POST, all_paths::API_V3_CONFIGURE_ADMIN_TOKEN_REGENERATE) => {
            http_server.regenerate_admin_token(req).await
        }
        (Method::POST, all_paths::API_V3_CONFIGURE_NAMED_ADMIN_TOKEN) => {
            http_server.create_named_admin_token(req).await
        }
        (Method::POST, all_paths::API_LEGACY_WRITE) => {
            let params = match http_server.legacy_write_param_unifier.parse_v1(&req).await {
                Ok(p) => p.into(),