Remove redundant MW function

Author: philipgough

authentication/mtls.go

@@ -193,82 +193,3 @@ func (a MTLSAuthenticator) Handler() (string, http.Handler) {
 	return "", nil
 }
 
-// PathAwareMiddleware creates a middleware that only enforces mTLS on matching paths
-func (a MTLSAuthenticator) PathAwareMiddleware(pathMatchers []*regexp.Regexp) Middleware {
-	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			// Check if the request path matches any of the configured patterns
-			pathMatches := false
-			for _, matcher := range pathMatchers {
-				if matcher.MatchString(r.URL.Path) {
-					pathMatches = true
-					break
-				}
-			}
-
-			// If no path matches, skip mTLS enforcement
-			if !pathMatches {
-				next.ServeHTTP(w, r)
-				return
-			}
-
-			// Path matches, enforce mTLS
-			if r.TLS == nil {
-				httperr.PrometheusAPIError(w, "mTLS required but no TLS connection", http.StatusBadRequest)
-				return
-			}
-
-			caPool := x509.NewCertPool()
-			for _, ca := range a.config.CAs {
-				caPool.AddCert(ca)
-			}
-
-			if len(r.TLS.PeerCertificates) == 0 {
-				httperr.PrometheusAPIError(w, "client certificate required for this path", http.StatusUnauthorized)
-				return
-			}
-
-			opts := x509.VerifyOptions{
-				Roots:         caPool,
-				Intermediates: x509.NewCertPool(),
-				KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
-			}
-
-			if len(r.TLS.PeerCertificates) > 1 {
-				for _, cert := range r.TLS.PeerCertificates[1:] {
-					opts.Intermediates.AddCert(cert)
-				}
-			}
-
-			if _, err := r.TLS.PeerCertificates[0].Verify(opts); err != nil {
-				if errors.Is(err, x509.CertificateInvalidError{}) {
-					httperr.PrometheusAPIError(w, err.Error(), http.StatusUnauthorized)
-					return
-				}
-				httperr.PrometheusAPIError(w, err.Error(), http.StatusInternalServerError)
-				return
-			}
-
-			var sub string
-			switch {
-			case len(r.TLS.PeerCertificates[0].EmailAddresses) > 0:
-				sub = r.TLS.PeerCertificates[0].EmailAddresses[0]
-			case len(r.TLS.PeerCertificates[0].URIs) > 0:
-				sub = r.TLS.PeerCertificates[0].URIs[0].String()
-			case len(r.TLS.PeerCertificates[0].DNSNames) > 0:
-				sub = r.TLS.PeerCertificates[0].DNSNames[0]
-			case len(r.TLS.PeerCertificates[0].IPAddresses) > 0:
-				sub = r.TLS.PeerCertificates[0].IPAddresses[0].String()
-			default:
-				httperr.PrometheusAPIError(w, "could not determine subject", http.StatusBadRequest)
-				return
-			}
-			ctx := context.WithValue(r.Context(), subjectKey, sub)
-
-			// Add organizational units as groups.
-			ctx = context.WithValue(ctx, groupsKey, r.TLS.PeerCertificates[0].Subject.OrganizationalUnit)
-
-			next.ServeHTTP(w, r.WithContext(ctx))
-		})
-	}
-}