feat: /mon/status returns details only for maintainer (#5795)

Author: richardlt

engine/api/api_routes.go

@@ -129,7 +129,7 @@ func (api *API) InitRouter() {
 	r.Handle("/broadcast/{id}/mark", Scope(sdk.AuthConsumerScopeProject), r.POST(api.postMarkAsReadBroadcastHandler))
 
 	// Overall health
-	r.Handle("/mon/status", ScopeNone(), r.GET(api.statusHandler, service.OverrideAuth(service.NoAuthMiddleware)))
+	r.Handle("/mon/status", ScopeNone(), r.GET(api.statusHandler, service.OverrideAuth(api.authOptionalMiddleware)))
 	r.Handle("/mon/version", ScopeNone(), r.GET(service.VersionHandler, service.OverrideAuth(service.NoAuthMiddleware)))
 	r.Handle("/mon/db/migrate", ScopeNone(), r.GET(api.getMonDBStatusMigrateHandler, service.OverrideAuth(api.authAdminMiddleware)))
 	r.Handle("/mon/metrics", ScopeNone(), r.GET(service.GetPrometheustMetricsHandler(api), service.OverrideAuth(service.NoAuthMiddleware)))

engine/api/status.go

@@ -48,11 +48,18 @@ func (api *API) statusHandler() service.Handler {
 			status = http.StatusServiceUnavailable
 		}
 
+		// Always load services to ensure that database connection is ok.
 		srvs, err := services.LoadAll(ctx, api.mustDB(), services.LoadOptions.WithStatus)
 		if err != nil {
 			return err
 		}
 
+		// If there is a valid session and user is maintainer, allows to get status details.
+		currentConsumer := getAPIConsumer(ctx)
+		if currentConsumer == nil || !isMaintainer(ctx) {
+			return service.WriteJSON(w, nil, status)
+		}
+
 		mStatus := api.computeGlobalStatus(srvs)
 		return service.WriteJSON(w, mStatus, status)
 	}