Package com.tnsai.server.security

Class AuthFilter

java.lang.Object

com.tnsai.server.security.AuthFilter

public final class AuthFilter
extends Object

HTTP + WebSocket authentication filter (TNS-302).

Validates Authorization: Bearer <token> on every request. Health endpoints (probes for orchestrators) are explicitly exempt — the rest of the surface returns 401 on missing or mismatched tokens. The same handler is registered as before(...) for HTTP and wsBeforeUpgrade(...) for the WS upgrade, so unauthenticated upgrades never see a connected socket.

The token comparison is constant-time over the value bytes (length is not secret).

Constructor Summary

Constructors

Constructor	Description
AuthFilter(AuthConfig config)

Method Summary

Modifier and Type	Method	Description
void	before(io.javalin.http.Context ctx)	Runs as before(...) for HTTP and wsBeforeUpgrade(...) for the WS upgrade.
AuthConfig	config()

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

AuthFilter

public AuthFilter(AuthConfig config)

Method Details

config

public AuthConfig config()

before

public void before(io.javalin.http.Context ctx)

Runs as before(...) for HTTP and wsBeforeUpgrade(...) for the WS upgrade. Short-circuits with 401 when auth is required and the request is missing or has a wrong token. No-op on the public probe paths and when AuthConfig.isEnabled() is false.