fix: authenticate /internal/admin and /gw/*proxy (#672 #665) - #695
Conversation
…#665) - /internal/admin/reset-circuit-breakers was reachable without auth; now requires Auth + PermissionFullAccess (poyrazK#672). - /gw/*proxy was reachable without auth; now requires Auth so the per-tenant routing rules cannot be exercised anonymously (poyrazK#665).
|
Warning Review limit reached
Your plan includes 1 review of capacity. Refill in 59 minutes and 21 seconds. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more review capacity refills, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Secures previously public/internal endpoints by adding authentication (and RBAC for internal admin), reducing unauthorized access to sensitive routes.
Changes:
- Added authentication middleware to the
/gw/*proxygateway proxy route. - Added authentication +
PermissionFullAccessguard to/internal/adminendpoints.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| // The actual Gateway Proxy (authenticated) | ||
| r.Any("/gw/*proxy", | ||
| httputil.Auth(services.Identity, services.Tenant), | ||
| handlers.Gateway.Proxy, | ||
| ) |
| // Internal admin endpoints (E2E test support) | ||
| internalGroup := r.Group("/internal/admin") | ||
| internalGroup.Use( | ||
| httputil.Auth(svcs.Identity, svcs.Tenant), | ||
| httputil.Permission(svcs.RBAC, domain.PermissionFullAccess), | ||
| ) |
Authenticates two previously unauthenticated endpoints: