наблюдаемость: ввести безопасный контракт метрик

crates/crank-observability/src/prometheus.rs

@@ -155,7 +155,7 @@ impl MetricsSurface {
         Router::new()
             .route("/metrics", get(render_metrics))
             .route("/health", get(metrics_health))
-            .layer(middleware::from_fn_with_state(
+            .route_layer(middleware::from_fn_with_state(
                 self.state.clone(),
                 authorize_metrics,
             ))
@@ -179,6 +179,12 @@ pub struct MetricsServer {
 }
 
 impl MetricsServer {
+    pub fn local_addr(&self) -> Result<SocketAddr, MetricsServeError> {
+        self.listener
+            .local_addr()
+            .map_err(|_| MetricsServeError::LocalAddress)
+    }
+
     pub async fn serve(self) -> Result<(), MetricsServeError> {
         axum::serve(self.listener, self.router)
             .await
@@ -198,6 +204,8 @@ pub enum MetricsServeError {
     Bind,
     #[error("metrics listener stopped unexpectedly")]
     Serve,
+    #[error("failed to read metrics listener address")]
+    LocalAddress,
 }
 
 pub(crate) fn install_prometheus_recorder(
@@ -257,10 +265,15 @@ async fn authorize_metrics(
 }
 
 fn bearer_token(headers: &HeaderMap) -> Option<&[u8]> {
-    headers
-        .get(header::AUTHORIZATION)?
-        .as_bytes()
-        .strip_prefix(b"Bearer ")
+    let value = headers.get(header::AUTHORIZATION)?.as_bytes();
+    let separator = value.iter().position(|byte| *byte == b' ')?;
+    let (scheme, token_with_spaces) = value.split_at(separator);
+    let token_start = token_with_spaces.iter().position(|byte| *byte != b' ')?;
+    let token = &token_with_spaces[token_start..];
+
+    scheme
+        .eq_ignore_ascii_case(b"bearer")
+        .then_some(token)
         .filter(|token| !token.is_empty())
 }