`/status` accessible without auth if metrics endpoint is enabled

[VladRassokhin]

1. Running bazel-remove with --enable_endpoint_metrics and some auth, e.g. --htpasswd_file, but without --allow_unauthenticated_reads.
2. curl http://localhost:9090/status succeeds, while it should've fail 401.

Cause:

bazel-remote/main.go

Line 324 in a69b6b5

statusHandler = middlewarestd.Handler("status", metricsMdlw, http.HandlerFunc(h.StatusPageHandler)).ServeHTTP

overwrites previous auth-protected statusHandler

Will send MR shortly.

[VladRassokhin]

Here's a test

Subject: [PATCH] /status accessible without auth if metrics endpoint is enabled
---
Index: .bazelci/basic-auth-tests.sh
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/.bazelci/basic-auth-tests.sh b/.bazelci/basic-auth-tests.sh
--- a/.bazelci/basic-auth-tests.sh	(revision a69b6b5ed933234d93b489ffd216bee5bb74aa06)
+++ b/.bazelci/basic-auth-tests.sh	(date 1788193665196)
@@ -144,6 +144,7 @@
 kill -9 $server_pid
 sleep 2
 ./bazel-remote --dir "$tmpdir/cache" --max_size 1 --http_address "0.0.0.0:$HTTP_PORT" \
+  --enable_endpoint_metrics \
 	--htpasswd_file "$tmpdir/htpasswd" > "$tmpdir/bazel-remote-authenticated.log" 2>&1 &
 server_pid=$!
 
@@ -185,6 +186,15 @@
 	kill -9 $server_pid
 	exit 1
 fi
+
+# Unauthenticated status read should fail.
+if wget --inet4-only -d -O - --timeout=2 \
+	"http://localhost:$HTTP_PORT/status"
+then
+	echo "Error: expected unauthenticated read to fail"
+	kill -9 $server_pid
+	exit 1
+fi
 
 # Run without auth, expect no access.
 if ! bazel run //utils/grpcreadclient -- -server-addr localhost:9092

[mostynb]

Hi, I think the /status endpoint should always be accessible- I don't think there's any sensitive information in the /status endpoint. This doesn't count as reading from the cache.

[VladRassokhin]

@mostynb maybe, but then let's drop other code which hides it after auth check :)
That would also allow using /status for k8s health checks.