Module: Insika::Server::AdminAuth

Defined in:
lib/insika/server/admin_auth.rb

Overview

Minimal operator auth. Fail-closed BY CONSTRUCTION: with no token configured, /admin does not exist to the world (503) — never open by omission. Pure module, testable without a Rack env.

Class Method Summary collapse

Class Method Details

.check(config_token, header) ⇒ Object

config_token: config (the wiring reads ADMIN_TOKEN). header: raw Authorization value. -> :disabled | :unauthorized | :ok



17
18
19
20
21
22
23
24
25
26
 
# File 'lib/insika/server/admin_auth.rb', line 17

def check(config_token, header)
  return :disabled if config_token.nil? || config_token.empty?

  provided = header.to_s[/\ABearer (.+)\z/, 1]
  return :unauthorized if provided.nil?
  # Constant-time comparison: the operator token doesn't leak via timing.
  return :unauthorized unless Rack::Utils.secure_compare(config_token, provided)

  :ok
end