chris/OSVauco
1
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix(main): exempt health/readiness paths from IAP middleware

Browse Source 
/health and probe endpoints reach Cloud Run directly without the
IAP-injected x-goog-authenticated-user-email header. Without an
exemption the middleware returned 401 on /health, which would break
Cloud Run health checks, CI/CD deploys, and the Phase 8 verification.

Powered by Jason, Crafted by Vauco
This commit is contained in:
Jason Vauger 2026-06-01 12:30:06 +00:00
parent b751a6fd38
commit 7a098716ae
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
main.py
View File

@ -51,8 +51,14 @@ app = FastAPI(
version="0.1.0", version="0.1.0",
) )
# Paths exempt from IAP enforcement (health/readiness probes reach Cloud Run
# directly without the IAP-injected x-goog-authenticated-user-email header).
IAP_EXEMPT_PATHS = {"/health", "/healthz", "/readiness", "/liveness"}
@app.middleware("http") @app.middleware("http")
async def require_iap(request: Request, call_next): async def require_iap(request: Request, call_next):
if request.url.path in IAP_EXEMPT_PATHS:
return await call_next(request)
if not request.headers.get("x-goog-authenticated-user-email"): if not request.headers.get("x-goog-authenticated-user-email"):
return Response(status_code=401, content="Unauthorized") return Response(status_code=401, content="Unauthorized")
return await call_next(request) return await call_next(request)