tokenAuthenticator method

Authenticator tokenAuthenticator()

The authenticator guarding /api/v1. Never null: the Hub is controlled only with the apiToken or a grant's (principal, token) pair, so an unauthenticated caller is refused whether or not an apiToken is set.

It used to return null when no apiToken was configured, which left the API wide open — --grant alone gates the node channel, and is only consulted from inside this authenticator, so without it nothing checked anything. A Hub with neither an API token nor a grant now authenticates nobody rather than everybody.

A hub hosting buildServices itself must apply this to the service named apiServiceName — that is the only one behind the token. /healthz and /metrics are deliberately outside it.

Implementation

Authenticator tokenAuthenticator() => _tokenAuth();