From f5b22063e38e3984ca86d14112ae59d2c67b3769 Mon Sep 17 00:00:00 2001 From: nutcas3 Date: Sat, 25 Apr 2026 06:02:06 +0300 Subject: [PATCH] feat: Add configurable authentication enforcement to charging engine with ENFORCE_AUTH environment variable - Add ENFORCE_AUTH environment variable with true default to auth middleware - Add early return when ENFORCE_AUTH=false for development/testing bypass - Replace development comment with UNAUTHORIZED status code when no valid authentication found - Move authentication bypass logic from end of function to environment-based check at start --- apps/charging-engine/src/auth.rs | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/apps/charging-engine/src/auth.rs b/apps/charging-engine/src/auth.rs index db142f4..fb4a761 100644 --- a/apps/charging-engine/src/auth.rs +++ b/apps/charging-engine/src/auth.rs @@ -74,6 +74,16 @@ pub async fn auth_middleware( request: Request, next: Next, ) -> Result { + // Check if authentication is enforced via environment variable + let enforce_auth = env::var("ENFORCE_AUTH") + .unwrap_or_else(|_| "true".to_string()) + .to_lowercase() == "true"; + + if !enforce_auth { + // Allow requests without auth for development/testing + return Ok(next.run(request).await); + } + let auth_header = request .headers() .get("Authorization") @@ -101,7 +111,6 @@ pub async fn auth_middleware( } } - // Allow requests without auth for development/testing - // In production, you would want to enable strict authentication - Ok(next.run(request).await) + // No valid authentication found + Err(StatusCode::UNAUTHORIZED) }