chris/OSVauco
1
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/fix/iap-middleware'

Browse Source
This commit is contained in:
Chris Christiansen 2026-06-03 22:48:45 +00:00
commit ae582aedeb
1 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
main.py
View File

@ -16,7 +16,7 @@ import pathlib
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "agents", "core-logic")) sys.path.insert(0, os.path.join(os.path.dirname(__file__), "agents", "core-logic"))
from fastapi import FastAPI, HTTPException, Request from fastapi import FastAPI, HTTPException, Request
from fastapi.responses import FileResponse, JSONResponse, RedirectResponse from fastapi.responses import FileResponse, JSONResponse, RedirectResponse, Response
from fastapi.staticfiles import StaticFiles from fastapi.staticfiles import StaticFiles
from pydantic import BaseModel, Field from pydantic import BaseModel, Field
from typing import List from typing import List
@ -51,6 +51,18 @@ app = FastAPI(
version="0.1.0", version="0.1.0",
) )
# Paths exempt from IAP enforcement (health/readiness probes reach Cloud Run
# directly without the IAP-injected x-goog-authenticated-user-email header).
IAP_EXEMPT_PATHS = {"/health", "/healthz", "/readiness", "/liveness"}
@app.middleware("http")
async def require_iap(request: Request, call_next):
if request.url.path in IAP_EXEMPT_PATHS:
return await call_next(request)
if not request.headers.get("x-goog-authenticated-user-email"):
return Response(status_code=401, content="Unauthorized")
return await call_next(request)
# ── FIREBASE & FIRESTORE INIT ─────────────────────────────────────────────── # ── FIREBASE & FIRESTORE INIT ───────────────────────────────────────────────
db = None db = None
try: try: