Allow /metrics by default if auth is off

[blairdrummond]

Resolves #5973

How to test:

Use this dockerfile to compare

FROM jupyter/minimal-notebook:5cb007f03275  
RUN pip3 install -U git+git://github.com/blairdrummond/notebook.git@prometheus-auth-default

And run docker build . -t jupyter-prom-test

Using the old image, /metrics is blocked even if auth is off

# Auth is ENABLED
docker run -p 8888:8888 \
    -e JUPYTER_ENABLE_LAB=yes  \
     jupyter/minimal-notebook:5cb007f03275 jupyter notebook \
    --no-browser --ip=0.0.0.0  --ServerApp.allow_origin='*'

# Doesn't work, which is GOOD
curl http://0.0.0.0:8888/metrics

# Works
TOKEN=XXXXXXXXX
curl "http://0.0.0.0:8888/metrics?token=$TOKEN"

# Auth is OFF
docker run -p 8888:8888 \
    -e JUPYTER_ENABLE_LAB=yes  \
     jupyter/minimal-notebook:5cb007f03275 jupyter notebook \
    --no-browser --ip=0.0.0.0  --ServerApp.allow_origin='*' \
    --NotebookApp.token='' --ServerApp.password=''

##############################
# Doesn't work, which is BAD!!!!!!!!!!!!
curl http://0.0.0.0:8888/metrics

Using the new image

# Auth is ENABLED
docker run -p 8888:8888 \
    -e JUPYTER_ENABLE_LAB=yes  \
    jupyter-prom-test jupyter notebook \
    --no-browser --ip=0.0.0.0  --ServerApp.allow_origin='*'

# Doesn't work, which is GOOD
curl http://0.0.0.0:8888/metrics

# Works
TOKEN=XXXXXXXXX
curl "http://0.0.0.0:8888/metrics?token=$TOKEN"

# Auth is OFF
docker run -p 8888:8888 \
    -e JUPYTER_ENABLE_LAB=yes  \
    jupyter-prom-test jupyter notebook \
    --no-browser --ip=0.0.0.0  --ServerApp.allow_origin='*' \
    --NotebookApp.token='' --ServerApp.password=''

##############################
# Works!!! Which is GOOD!!!!!!!!!!!!
curl http://0.0.0.0:8888/metrics

[kevin-bates]

Hi @blairdrummond - thank you for the pull request.

While this approach will certainly work, I was envisioning the initialization of authenticate_prometheus's default value (which is currently hard-coded to True) as the means of addressing this. This way, references to the other two trait values can remain in the application module.

A great example of this happens to be for the token trait's default-value function in which it checks the password's value. I think adding a _default_authenticate_prometheus() function that checks the token and password values would be the appropriate approach with the ultimate default value being True.

Another example is the mathjax_url default checking the enable_mathjax trait.

I hope that helps. Thank again.

[kevin-bates]

Excellent update! I really like the idea of an informational message, but since authentication is on by default, I think it would be best to only indicate when it's disabled, particularly now that it can be disabled implicitly. Thanks!

[blairdrummond]

@kevin-bates how's this?

[kevin-bates]

Thanks Blair!