in src/main/java/com/googlesource/gerrit/plugins/javamelody/GerritMonitoringFilter.java [197:212]
boolean canMonitor(HttpServletRequest httpRequest) {
if (httpRequest.getRequestURI().equals(getJavamelodyUrl(httpRequest))) {
/* Exception when access to metrics for Prometheus using Bearer Token
* without going through any Gerrit Authentication step.
* Enable to access the Prometheus metrics ONLY and nothing else, skipping
* any authentication and ACL check.
*/
if (useBearerTokenForPrometheus
&& httpRequest.getHeader(AUTHORIZATION_HEADER) != null
&& FORMAT_PROMETHEUS.equals(HttpParameter.FORMAT.getParameterFrom(httpRequest))) {
return canMonitorFromPrometheusUsingBearerToken(httpRequest);
}
return capabilityChecker.canMonitor();
}
return true;
}