Make this an internal endpoint

api/http.go

@@ -79,12 +79,6 @@ func NewCatalystAPIRouter(cli config.Cli, vodEngine *pipeline.Coordinator, bal b
 	for _, path := range [...]string{"/asset/hls/:playbackID/*file", "/webrtc/:playbackID"} {
 		router.OPTIONS(path, playback)
 	}
-	image := middleware.LogAndMetrics(metrics.Metrics.ImageAPIDurationSec)(
-		withCORS(
-			handlers.NewImageHandler(cli.PublicBucketURLs).Handle,
-		),
-	)
-	router.GET("/asset/image/:playbackID/thumbnail.jpg", image)
 
 	// Handling incoming playback redirection requests
 	redirectHandler := withLogging(withCORS(geoHandlers.RedirectHandler()))

api/http_internal.go

@@ -23,6 +23,7 @@ import (
 	"github.com/livepeer/catalyst-api/handlers/misttriggers"
 	"github.com/livepeer/catalyst-api/log"
 	mistapiconnector "github.com/livepeer/catalyst-api/mapic"
+	"github.com/livepeer/catalyst-api/metrics"
 	"github.com/livepeer/catalyst-api/middleware"
 	"github.com/livepeer/catalyst-api/pipeline"
 	"github.com/livepeer/go-api-client"
@@ -113,6 +114,14 @@ func NewCatalystAPIRouterInternal(cli config.Cli, vodEngine *pipeline.Coordinato
 			),
 		),
 	)
+	router.GET("/api/image/:playbackID/thumbnail.jpg",
+		middleware.LogAndMetrics(metrics.Metrics.ImageAPIDurationSec)(
+			withAuth(
+				cli.APIToken,
+				handlers.NewImageHandler(cli.PrivateBucketURLs).Handle,
+			),
+		),
+	)
 
 	// Public handler to propagate an event to all Catalyst nodes
 	router.POST("/api/events", withLogging(eventsHandler.Events()))

handlers/image.go

@@ -162,7 +162,9 @@ func (p *ImageHandler) handle(w http.ResponseWriter, playbackID string, t float6
 
 	// extract image
 	extractStart := time.Now()
-	defer metrics.Metrics.ImageAPIExtractDurationSec.WithLabelValues().Observe(time.Since(extractStart).Seconds())
+	defer func() {
+		metrics.Metrics.ImageAPIExtractDurationSec.WithLabelValues().Observe(time.Since(extractStart).Seconds())
+	}()
 
 	var ffmpegErr bytes.Buffer
 	err = ffmpeg.