fix: don't try to use authenticators if none are configured

authn/authn.go

@@ -30,6 +30,14 @@ import (
 func GetAuthenticationHeaders(ctx context.Context, endpoint *url.URL, authenticators map[string]string) (http.Header, error) {
 	logger := log.FromContext(ctx).Scope(endpoint.Hostname())
 
+	// Next, try the authenticator.
+	logger.Debugf("Trying authenticator")
+	authenticator, ok := authenticators[endpoint.Hostname()]
+	if !ok {
+		logger.Tracef("No authenticator found for %s in %s", endpoint, authenticators)
+		return nil, nil
+	}
+
 	endpoint = &url.URL{
 		Scheme: endpoint.Scheme,
 		Host:   endpoint.Host,
@@ -60,14 +68,6 @@ func GetAuthenticationHeaders(ctx context.Context, endpoint *url.URL, authentica
 		}
 	}
 
-	// Next, try the authenticator.
-	logger.Debugf("Trying authenticator")
-	authenticator, ok := authenticators[endpoint.Hostname()]
-	if !ok {
-		logger.Tracef("No authenticator found in %s", authenticators)
-		return nil, nil
-	}
-
 	cmd := exec.Command(ctx, log.Error, ".", authenticator, endpoint.String())
 	out := &strings.Builder{}
 	cmd.Stdout = out
@@ -152,6 +152,9 @@ func checkAuth(ctx context.Context, logger *log.Logger, endpoint *url.URL, creds
 
 // Transport returns a transport that will authenticate requests to the given endpoints.
 func Transport(next http.RoundTripper, authenticators map[string]string) http.RoundTripper {
+	if len(authenticators) == 0 {
+		return next
+	}
 	return &authnTransport{
 		authenticators: authenticators,
 		credentials:    map[string]http.Header{},

go.mod

@@ -5,7 +5,7 @@ go 1.21
 require (
 	connectrpc.com/connect v1.11.1
 	github.com/BurntSushi/toml v1.3.2
-	github.com/alecthomas/kong v0.8.0
+	github.com/alecthomas/kong v0.8.1
 	github.com/alecthomas/kong-toml v0.0.0-20230922031405-31cfb1264a3b
 	github.com/go-logr/logr v1.2.4
 	github.com/golang/protobuf v1.5.3