From bc6113c80dbaff1bc7a0b306113090521a7d98ed Mon Sep 17 00:00:00 2001
From: Virgil <virgil@lethean.io>
Date: Sun, 5 Apr 2026 02:43:49 +0000
Subject: [PATCH] fix(api): enforce GET on monitoring routes

Co-Authored-By: Virgil <virgil@lethean.io>
---
 http_auth_test.go | 18 +++++++++++++++++-
 state_impl.go     |  2 +-
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/http_auth_test.go b/http_auth_test.go
index b7480dc..da87eed 100644
--- a/http_auth_test.go
+++ b/http_auth_test.go
@@ -57,7 +57,7 @@ func TestProxy_allowHTTP_Unrestricted_Good(t *testing.T) {
 		},
 	}
 
-	status, ok := p.allowMonitoringRequest(&http.Request{Method: http.MethodPost})
+	status, ok := p.allowMonitoringRequest(&http.Request{Method: http.MethodGet})
 	if !ok {
 		t.Fatalf("expected unrestricted request to pass, got status %d", status)
 	}
@@ -66,6 +66,22 @@ func TestProxy_allowHTTP_Unrestricted_Good(t *testing.T) {
 	}
 }
 
+func TestProxy_allowHTTP_Unrestricted_Bad(t *testing.T) {
+	p := &Proxy{
+		config: &Config{
+			HTTP: HTTPConfig{},
+		},
+	}
+
+	status, ok := p.allowMonitoringRequest(&http.Request{Method: http.MethodPost})
+	if ok {
+		t.Fatal("expected non-GET request to be rejected even when unrestricted")
+	}
+	if status != http.StatusMethodNotAllowed {
+		t.Fatalf("expected status %d, got %d", http.StatusMethodNotAllowed, status)
+	}
+}
+
 func TestProxy_allowHTTP_Ugly(t *testing.T) {
 	p := &Proxy{
 		config: &Config{
diff --git a/state_impl.go b/state_impl.go
index e2ff50d..26c8636 100644
--- a/state_impl.go
+++ b/state_impl.go
@@ -675,7 +675,7 @@ func (p *Proxy) allowMonitoringRequest(r *http.Request) (int, bool) {
 	if p == nil || p.config == nil {
 		return http.StatusServiceUnavailable, false
 	}
-	if p.config.HTTP.Restricted && r.Method != http.MethodGet {
+	if r.Method != http.MethodGet {
 		return http.StatusMethodNotAllowed, false
 	}
 	if token := p.config.HTTP.AccessToken; token != "" {