fix(proxy): authenticateV1 Warnf + JWT test coverage (CRAP 42→9)

- proxy.go: log Warnf when jwtValidator==nil so auth bypass is observable - proxy_test.go: TestAuthenticateV1ProxyLevel covers 401/403/pass branches (authenticateV1 cov: 10.5% → 77.3%, CRAP: 42 → 8.5)
2026-09-27 19:09:10 +08:00
parent a9a151a8b4
commit 6257b8c201
2 changed files with 147 additions and 1 deletions
@@ -495,7 +495,11 @@ func (h *Handler) writeModelValidationError(w http.ResponseWriter, validationErr
 // authenticateV1 validates JWT for /v1/* paths.
 // Returns false when auth fails (response already written).
 func (h *Handler) authenticateV1(w http.ResponseWriter, r *http.Request) bool {
-	if h.jwtValidator == nil || !strings.HasPrefix(r.URL.Path, "/v1/") {
+	if h.jwtValidator == nil {
+		logging.Warnf("JWT auth disabled; /v1/* request unauthenticated", map[string]string{"path": r.URL.Path})
+		return true
+	}
+	if !strings.HasPrefix(r.URL.Path, "/v1/") {
 		return true
 	}
 	authHeader := r.Header.Get("Authorization")