From 7a098716aec729fa52c0f807bc819a91eeb76880 Mon Sep 17 00:00:00 2001 From: Jason Vauger Date: Mon, 1 Jun 2026 12:30:06 +0000 Subject: [PATCH] fix(main): exempt health/readiness paths from IAP middleware /health and probe endpoints reach Cloud Run directly without the IAP-injected x-goog-authenticated-user-email header. Without an exemption the middleware returned 401 on /health, which would break Cloud Run health checks, CI/CD deploys, and the Phase 8 verification. Powered by Jason, Crafted by Vauco --- main.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/main.py b/main.py index 8b23f2b..c576f95 100644 --- a/main.py +++ b/main.py @@ -51,8 +51,14 @@ app = FastAPI( version="0.1.0", ) +# Paths exempt from IAP enforcement (health/readiness probes reach Cloud Run +# directly without the IAP-injected x-goog-authenticated-user-email header). +IAP_EXEMPT_PATHS = {"/health", "/healthz", "/readiness", "/liveness"} + @app.middleware("http") async def require_iap(request: Request, call_next): + if request.url.path in IAP_EXEMPT_PATHS: + return await call_next(request) if not request.headers.get("x-goog-authenticated-user-email"): return Response(status_code=401, content="Unauthorized") return await call_next(request)