[t-003] Create auth.py — Bearer token middleware #3

New issue

Open

opened 2026-07-05 08:30:58 +00:00 by david · 0 comments

david commented 2026-07-05 08:30:58 +00:00

Owner

Copy link

Goal

Implement FastAPI dependency-based bearer token authentication for all endpoints.

References

Reference

• DESIGN.md §7 Security (Bearer auth middleware)
• AGENT.md §10 Security Constraints

Implementation Steps

Implementation Steps

1. Create src/core/auth.py

Create the auth module with:

# src/core/auth.py
from fastapi import Request, HTTPException
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
from src.core.config import load_config

security = HTTPBearer(auto_error=False)

def authenticate(credentials: HTTPAuthorizationCredentials | None) -> str:
    if credentials is None:
        raise HTTPException(status_code=401, detail="auth_invalid")
    config = load_config()
    expected_key = config.server.api_key
    if credentials.credentials != expected_key:
        raise HTTPException(status_code=401, detail="auth_invalid")
    return credentials.credentials

2. Create src/core/exceptions.py (placeholder — will be expanded in t-018)

For now, create a minimal exceptions module that handles the auth_invalid case:

# src/core/exceptions.py
from fastapi import Request
from fastapi.responses import JSONResponse

def handle_http_exception(request: Request, exc: HTTPException) -> JSONResponse:
    return JSONResponse(
        status_code=exc.status_code,
        content={"error": exc.detail},
    )

Verification Gate

Verification Gate

Run:

cd /home/david/Projects/keryx-bff && uv run python -c "from src.core.auth import authenticate; from fastapi.security import HTTPAuthorizationCredentials; print(authenticate(HTTPAuthorizationCredentials(credentials='keryx-bff-change-me')))"
# Expected output: keryx-bff-change-me

And verify rejection:

cd /home/david/Projects/keryx-bff && uv run python -c "from src.core.auth import authenticate; from fastapi.security import HTTPAuthorizationCredentials; authenticate(HTTPAuthorizationCredentials(credentials='wrong-key'))" 2>&1 | grep auth_invalid
# Expected: output contains 'auth_invalid'

STOP Conditions

STOP Conditions

• If the wrong key test does not raise an exception with detail "auth_invalid", stop and fix.

Depends on: t-002

## Goal Implement FastAPI dependency-based bearer token authentication for all endpoints. ## References ## Reference - DESIGN.md §7 Security (Bearer auth middleware) - AGENT.md §10 Security Constraints ## Implementation Steps ## Implementation Steps ### 1. Create `src/core/auth.py` Create the auth module with: ```python # src/core/auth.py from fastapi import Request, HTTPException from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials from src.core.config import load_config security = HTTPBearer(auto_error=False) def authenticate(credentials: HTTPAuthorizationCredentials | None) -> str: if credentials is None: raise HTTPException(status_code=401, detail="auth_invalid") config = load_config() expected_key = config.server.api_key if credentials.credentials != expected_key: raise HTTPException(status_code=401, detail="auth_invalid") return credentials.credentials ``` ### 2. Create `src/core/exceptions.py` (placeholder — will be expanded in t-018) For now, create a minimal exceptions module that handles the auth_invalid case: ```python # src/core/exceptions.py from fastapi import Request from fastapi.responses import JSONResponse def handle_http_exception(request: Request, exc: HTTPException) -> JSONResponse: return JSONResponse( status_code=exc.status_code, content={"error": exc.detail}, ) ``` ## Verification Gate ## Verification Gate Run: ```bash cd /home/david/Projects/keryx-bff && uv run python -c "from src.core.auth import authenticate; from fastapi.security import HTTPAuthorizationCredentials; print(authenticate(HTTPAuthorizationCredentials(credentials='keryx-bff-change-me')))" # Expected output: keryx-bff-change-me ``` And verify rejection: ```bash cd /home/david/Projects/keryx-bff && uv run python -c "from src.core.auth import authenticate; from fastapi.security import HTTPAuthorizationCredentials; authenticate(HTTPAuthorizationCredentials(credentials='wrong-key'))" 2>&1 | grep auth_invalid # Expected: output contains 'auth_invalid' ``` ## STOP Conditions ## STOP Conditions - If the wrong key test does not raise an exception with detail "auth_invalid", stop and fix. Depends on: t-002

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

No results found.

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: david/keryx-bff#3

No description provided.