fix(main): add global IAP middleware requiring x-goog-authenticated-user-email

main.py

@@ -16,7 +16,7 @@ import pathlib
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "agents", "core-logic"))
 
 from fastapi import FastAPI, HTTPException, Request
-from fastapi.responses import FileResponse, JSONResponse, RedirectResponse
+from fastapi.responses import FileResponse, JSONResponse, RedirectResponse, Response
 from fastapi.staticfiles import StaticFiles
 from pydantic import BaseModel, Field
 from typing import List
@@ -51,6 +51,12 @@ app = FastAPI(
     version="0.1.0",
 )
 
+@app.middleware("http")
+async def require_iap(request: Request, call_next):
+    if not request.headers.get("x-goog-authenticated-user-email"):
+        return Response(status_code=401, content="Unauthorized")
+    return await call_next(request)
+
 # ── FIREBASE & FIRESTORE INIT ───────────────────────────────────────────────
 db = None
 try: