Method authMiddleware

enterprise/aibridgeproxyd/aibridgeproxyd.go:639–695

authMiddleware is a CONNECT middleware that extracts the Coder token from the Proxy-Authorization header and stores it in a requestContext in ctx.UserData for use by downstream handlers. Requests without valid credentials receive a 407 Proxy Authentication Required response with a challenge header,

(host string, ctx *goproxy.ProxyCtx)

//
// The token is extracted from the password field of basic auth.
func (s *Server) authMiddleware(host string, ctx *goproxy.ProxyCtx) (*goproxy.ConnectAction, string) {
	// Generate a unique connect session ID for this CONNECT request.
	// A UUID is used instead of goproxy's ctx.Session because ctx.Session is an
	// incrementing int64 that resets on process restart and is not globally unique.
	connectSessionID := uuid.New()

	logger := s.logger.With(
		slog.F("connect_id", connectSessionID.String()),
		slog.F("host", host),
	)

	// Determine the provider from the request hostname.
	provider := s.loadProviderRouter().providerFromHost(ctx.Req.URL.Hostname())
	// A concurrent Reload can swap the router between CONNECT matching
	// and provider lookup, so treat a missing mapping as a runtime miss.
	if provider == "" {
		logger.Warn(s.ctx, "rejecting CONNECT request with no provider mapping")
		return goproxy.RejectConnect, host
	}

	logger = logger.With(
		slog.F("provider", provider),
	)

	proxyAuth := ctx.Req.Header.Get("Proxy-Authorization")
	coderToken := extractCoderTokenFromProxyAuth(proxyAuth)

	// Reject requests for both missing and invalid credentials
	if coderToken == "" {
		hasAuth := proxyAuth != ""
		logger.Warn(s.ctx, "rejecting CONNECT request",
			slog.F("reason", map[bool]string{true: "invalid_credentials", false: "missing_credentials"}[hasAuth]),
		)

		// Send 407 challenge to allow clients to retry with credentials.
		ctx.Resp = newProxyAuthRequiredResponse(ctx.Req) //nolint:bodyclose // Response body is written by goproxy to the client
		return goproxy.RejectConnect, host
	}

	// Store the request context in UserData for downstream handlers.
	// goproxy propagates UserData to subsequent request/response contexts
	// for decrypted requests within this MITM session.
	ctx.UserData = &requestContext{
		ConnectSessionID: connectSessionID,
		CoderToken:       coderToken,
		Provider:         provider,
	}

	logger.Debug(s.ctx, "request CONNECT authenticated")

	// Record successful MITM CONNECT session establishment.
	if s.metrics != nil {
		s.metrics.ConnectSessionsTotal.WithLabelValues(RequestTypeMITM).Inc()
	}

	return goproxy.MitmConnect, host
}