From b751a6fd38316dad8b6d4d152d8f03cd9bfa7079 Mon Sep 17 00:00:00 2001 From: Chris Christiansen Date: Mon, 1 Jun 2026 04:09:11 +0000 Subject: [PATCH 1/2] fix(main): add global IAP middleware requiring x-goog-authenticated-user-email --- main.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/main.py b/main.py index 202de40..8b23f2b 100644 --- a/main.py +++ b/main.py @@ -16,7 +16,7 @@ import pathlib sys.path.insert(0, os.path.join(os.path.dirname(__file__), "agents", "core-logic")) from fastapi import FastAPI, HTTPException, Request -from fastapi.responses import FileResponse, JSONResponse, RedirectResponse +from fastapi.responses import FileResponse, JSONResponse, RedirectResponse, Response from fastapi.staticfiles import StaticFiles from pydantic import BaseModel, Field from typing import List @@ -51,6 +51,12 @@ app = FastAPI( version="0.1.0", ) +@app.middleware("http") +async def require_iap(request: Request, call_next): + if not request.headers.get("x-goog-authenticated-user-email"): + return Response(status_code=401, content="Unauthorized") + return await call_next(request) + # ── FIREBASE & FIRESTORE INIT ─────────────────────────────────────────────── db = None try: From 7a098716aec729fa52c0f807bc819a91eeb76880 Mon Sep 17 00:00:00 2001 From: Jason Vauger Date: Mon, 1 Jun 2026 12:30:06 +0000 Subject: [PATCH 2/2] fix(main): exempt health/readiness paths from IAP middleware /health and probe endpoints reach Cloud Run directly without the IAP-injected x-goog-authenticated-user-email header. Without an exemption the middleware returned 401 on /health, which would break Cloud Run health checks, CI/CD deploys, and the Phase 8 verification. Powered by Jason, Crafted by Vauco --- main.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/main.py b/main.py index 8b23f2b..c576f95 100644 --- a/main.py +++ b/main.py @@ -51,8 +51,14 @@ app = FastAPI( version="0.1.0", ) +# Paths exempt from IAP enforcement (health/readiness probes reach Cloud Run +# directly without the IAP-injected x-goog-authenticated-user-email header). +IAP_EXEMPT_PATHS = {"/health", "/healthz", "/readiness", "/liveness"} + @app.middleware("http") async def require_iap(request: Request, call_next): + if request.url.path in IAP_EXEMPT_PATHS: + return await call_next(request) if not request.headers.get("x-goog-authenticated-user-email"): return Response(status_code=401, content="Unauthorized") return await call_next(request)