fix: avoid regex-based bearer parsing

Author: gabedalmolin

src/controllers/metricsController.ts

@@ -5,20 +5,17 @@ import {
   renderMetrics,
 } from "../metrics/authMetrics";
 import { env } from "../config/env";
-
-const getBearerToken = (request: Request): string | null => {
-  const authorization = request.header("authorization");
-  const match = authorization?.match(/^Bearer\s+(.+)$/i);
-
-  return match?.[1]?.trim() || null;
-};
+import { extractBearerToken } from "../utils/bearerToken";
 
 export async function metrics(req: Request, res: Response) {
   if (!metricsEnabled) {
     return res.status(404).json({ message: "metrics disabled" });
   }
 
-  if (env.METRICS_AUTH_TOKEN && getBearerToken(req) !== env.METRICS_AUTH_TOKEN) {
+  if (
+    env.METRICS_AUTH_TOKEN &&
+    extractBearerToken(req.header("authorization")) !== env.METRICS_AUTH_TOKEN
+  ) {
     return res.status(401).json({
       error: {
         code: "METRICS_AUTHORIZATION_REQUIRED",

src/middlewares/authMiddleware.ts

@@ -3,6 +3,7 @@ import { SessionStatus } from "@prisma/client";
 import AppError from "../errors/AppError";
 import tokenService from "../services/tokenService";
 import sessionRepository from "../repositories/sessionRepository";
+import { extractBearerToken } from "../utils/bearerToken";
 
 export default async function authMiddleware(
   req: Request,
@@ -21,8 +22,7 @@ export default async function authMiddleware(
     );
   }
 
-  const match = authorization.match(/^Bearer\s+(.+)$/i);
-  const token = match?.[1];
+  const token = extractBearerToken(authorization);
   if (!token) {
     return next(
       new AppError({

src/utils/bearerToken.ts

@@ -0,0 +1,23 @@
+export function extractBearerToken(authorization: string | undefined): string | null {
+  if (!authorization) {
+    return null;
+  }
+
+  const trimmed = authorization.trim();
+  if (trimmed.length === 0) {
+    return null;
+  }
+
+  const separatorIndex = trimmed.indexOf(" ");
+  if (separatorIndex === -1) {
+    return null;
+  }
+
+  const scheme = trimmed.slice(0, separatorIndex);
+  if (scheme.toLowerCase() !== "bearer") {
+    return null;
+  }
+
+  const token = trimmed.slice(separatorIndex + 1).trim();
+  return token.length > 0 ? token : null;
+}