fix(health): minimize unauthenticated health responses

crates/aisix-admin/src/lib.rs

@@ -140,15 +140,12 @@ pub fn build_router(state: AdminState) -> Router {
 }
 
 async fn health(
-    axum::extract::State(state): axum::extract::State<AdminState>,
+    _state: axum::extract::State<AdminState>,
 ) -> (StatusCode, Json<serde_json::Value>) {
-    let snap = state.snapshot.load();
     (
         StatusCode::OK,
         Json(json!({
             "status": "ok",
-            "models": snap.models.len(),
-            "apikeys": snap.apikeys.len(),
         })),
     )
 }
@@ -328,7 +325,7 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn health_reports_snapshot_counts() {
+    async fn health_reports_only_minimal_status() {
         let app = build_router(build_state());
         let req = Request::builder()
             .uri("/health")
@@ -338,6 +335,21 @@ mod tests {
         assert_eq!(resp.status(), StatusCode::OK);
         let v = body_json(resp).await;
         assert_eq!(v["status"], "ok");
+        assert_eq!(v.as_object().map(|o| o.len()), Some(1));
+        assert!(v.get("models").is_none());
+        assert!(v.get("apikeys").is_none());
+    }
+
+    #[tokio::test]
+    async fn health_rejects_non_get_requests() {
+        let app = build_router(build_state());
+        let req = Request::builder()
+            .method("POST")
+            .uri("/health")
+            .body(Body::empty())
+            .unwrap();
+        let resp = run(app, req).await;
+        assert_eq!(resp.status(), StatusCode::METHOD_NOT_ALLOWED);
     }
 
     #[tokio::test]

crates/aisix-admin/src/openapi.rs

@@ -26,7 +26,7 @@ const OPENAPI_JSON: &str = r##"{
   "paths": {
     "/health": {
       "get": {
-        "summary": "process health + snapshot counts",
+        "summary": "minimal process health status",
         "security": [],
         "responses": {"200": {"description": "OK"}}
       }

crates/aisix-admin/src/state.rs

@@ -3,7 +3,7 @@
 //! Holds:
 //! - the bootstrap-config-provided `admin_keys` (auth)
 //! - the `ConfigStore` trait object (CRUD backend)
-//! - a `SnapshotHandle` for the /health endpoint (snapshot counts)
+//! - a `SnapshotHandle` for authenticated operator-health handlers
 //! - an optional `Metrics` handle — when present, `/metrics` renders
 //!   the same Prometheus exposition that the proxy's middleware writes to
 //!

crates/aisix-proxy/src/lib.rs

@@ -175,16 +175,12 @@ async fn drain_body(body: axum::body::Body) {
 }
 
 async fn health(
-    axum::extract::State(state): axum::extract::State<ProxyState>,
+    _state: axum::extract::State<ProxyState>,
 ) -> (StatusCode, Json<serde_json::Value>) {
-    let snap = state.snapshot.load();
     (
         StatusCode::OK,
         Json(json!({
             "status": "ok",
-            "models": snap.models.len(),
-            "apikeys": snap.apikeys.len(),
-            "providers": state.hub.len(),
         })),
     )
 }
@@ -406,6 +402,25 @@ mod tests {
         assert_eq!(v["error"]["type"], "invalid_api_key");
     }
 
+    #[tokio::test]
+    async fn health_reports_only_minimal_status() {
+        let hub = Arc::new(Hub::new());
+        let snap = seed_snapshot("my-gpt4", &["my-gpt4"], "http://unused");
+        let app = build_router(build_state(snap, hub));
+
+        let req = Request::builder()
+            .method("GET")
+            .uri("/health")
+            .body(Body::empty())
+            .unwrap();
+
+        let resp = run(app, req).await;
+        assert_eq!(resp.status(), StatusCode::OK);
+        let bytes = to_bytes(resp.into_body(), 1024).await.unwrap();
+        let v: serde_json::Value = serde_json::from_slice(&bytes).unwrap();
+        assert_eq!(v, serde_json::json!({"status": "ok"}));
+    }
+
     #[tokio::test]
     async fn unknown_api_key_returns_401() {
         let hub = Arc::new(Hub::new());

docs/api-admin.md

@@ -23,7 +23,7 @@ configured in the bootstrap YAML under `admin.admin_keys` (a list).
 
 The unauthenticated endpoints are:
 
-- `/health` — liveness probe.
+- `/health` — minimal unauthenticated status probe.
 - `/metrics` — Prometheus scrape (intended to be private).
 - `/admin/openapi.json`, `/admin/openapi-scalar` — the OpenAPI spec
   and the Scalar UI.

docs/testing.md

@@ -100,7 +100,7 @@ Lives in `tests/e2e/`. Each test:
    (`/aisix-e2e-<uuid>`) so concurrent runs cannot collide.
 4. Writes a YAML config to a temp dir.
 5. Spawns `target/debug/aisix --config <path>`.
-6. Waits up to 10 s for `/health` and `/admin/v1/health` to respond.
+6. Waits up to 10 s for the minimal `/health` probe and `/admin/v1/health` to respond.
 7. Drives the request scenario via the Admin and Proxy clients.
 8. Tears down: SIGTERM + 3 s grace + SIGKILL fallback, plus etcd
    prefix cleanup.