Repository: influxdata/influxdb
File: influxdb3_server/src/http.rs (Rust)

Code before:

    // admin token creation, health, ping and metrics endpoints aren't guarded
    if uri.path() != all_paths::API_V3_CONFIGURE_ADMIN_TOKEN
        && uri.path() != all_paths::API_V3_HEALTH
        && uri.path() != all_paths::API_V1_HEALTH
        && uri.path() != all_paths::API_METRICS
        && uri.path() != all_paths::API_PING
    {
        trace!(?uri, "authenticating request");
        if let Some(authentication_error) = authenticate(&http_server, &mut req).await {
            return authentication_error;
        }
    }

    trace!(request = ?req,"Processing request");
    let content_length = req.headers().get("content-length").cloned();

    let path = uri.path();
    let response = match (method.clone(), path) {
        (Method::POST, all_paths::API_V3_CONFIGURE_ADMIN_TOKEN) => {
            http_server.create_admin_token(req).await
        }
        (Method::POST, all_paths::API_V3_CONFIGURE_ADMIN_TOKEN_REGENERATE) => {
            http_server.regenerate_admin_token(req).await
        }
        (Method::POST, all_paths::API_LEGACY_WRITE) => {
            let params = match http_server.legacy_write_param_unifier.parse_v1(&req).await {
                Ok(p) => p.into(),
                Err(e) => return Ok(legacy_write_error_to_response(e)),
            };

            http_server.write_lp_inner(params, req, true).await
        }
        (Method::POST, all_paths::API_V2_WRITE) => {
            let params = match http_server.legacy_write_param_unifier.parse_v2(&req).await {
                Ok(p) => p.into(),
                Err(e) => return Ok(legacy_write_error_to_response(e)),
            };
            http_server.write_lp_inner(params, req, false).await
        }
        (Method::POST, all_paths::API_V3_WRITE) => http_server.write_lp(req).await,
        (Method::GET | Method::POST, all_paths::API_V3_QUERY_SQL) => {
            http_server.query_sql(req).await
        }
        (Method::GET | Method::POST, all_paths::API_V3_QUERY_INFLUXQL) => {
            http_server.query_influxql(req).await
        }
        (Method::GET | Method::POST, all_paths::API_V1_QUERY) => http_server.v1_query(req).await,
        (Method::GET, all_paths::API_V3_HEALTH | all_paths::API_V1_HEALTH) => http_server.health(),
        (Method::GET | Method::POST, all_paths::API_PING) => http_server.ping(),
        (Method::GET, all_paths::API_METRICS) => http_server.handle_metrics(),

Review comment (security):
For core, without a system user, should we always allow health/metrics/ping API or should we disallow by default and get users to use auth token to access these endpoints?

Code after:
            });
            Ok(Body::wrap_stream(stream))
        }
    }
}

pub(crate) async fn route_request(
    http_server: Arc<HttpApi>,
    mut req: Request<Body>,
    started_without_auth: bool,
) -> Result<Response<Body>, Infallible> {
    let method = req.method().clone();
    let uri = req.uri().clone();
    if started_without_auth && uri.path().starts_with(all_paths::API_V3_CONFIGURE_TOKEN) {
        return Ok(Response::builder()
            .status(StatusCode::METHOD_NOT_ALLOWED)
            .body("".into())
            .unwrap());
    }

    // admin token creation
    if uri.path() != all_paths::API_V3_CONFIGURE_ADMIN_TOKEN {
        trace!(?uri, "authenticating request");
        if let Some(authentication_error) = authenticate(&http_server, &mut req).await {
            return authentication_error;
        }
    }

    trace!(request = ?req,"Processing request");
    let content_length = req.headers().get("content-length").cloned();

    let path = uri.path();

    let response = match (method.clone(), path) {
        (Method::DELETE, all_paths::API_V3_CONFIGURE_TOKEN) => http_server.delete_token(req).await,
        (Method::POST, all_paths::API_V3_CONFIGURE_ADMIN_TOKEN) => {
            http_server.create_admin_token(req).await
        }
        (Method::POST, all_paths::API_V3_CONFIGURE_ADMIN_TOKEN_REGENERATE) => {
            http_server.regenerate_admin_token(req).await
        }
        (Method::POST, all_paths::API_LEGACY_WRITE) => {
            let params = match http_server.legacy_write_param_unifier.parse_v1(&req).await {
                Ok(p) => p.into(),
                Err(e) => return Ok(legacy_write_error_to_response(e)),
            };

            http_server.write_lp_inner(params, req, true).await
        }
        (Method::POST, all_paths::API_V2_WRITE) => {
            let params = match http_server.legacy_write_param_unifier.parse_v2(&req).await {