From b751a6fd38316dad8b6d4d152d8f03cd9bfa7079 Mon Sep 17 00:00:00 2001 From: Chris Christiansen Date: Mon, 1 Jun 2026 04:09:11 +0000 Subject: [PATCH] fix(main): add global IAP middleware requiring x-goog-authenticated-user-email --- main.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/main.py b/main.py index 202de40..8b23f2b 100644 --- a/main.py +++ b/main.py @@ -16,7 +16,7 @@ import pathlib sys.path.insert(0, os.path.join(os.path.dirname(__file__), "agents", "core-logic")) from fastapi import FastAPI, HTTPException, Request -from fastapi.responses import FileResponse, JSONResponse, RedirectResponse +from fastapi.responses import FileResponse, JSONResponse, RedirectResponse, Response from fastapi.staticfiles import StaticFiles from pydantic import BaseModel, Field from typing import List @@ -51,6 +51,12 @@ app = FastAPI( version="0.1.0", ) +@app.middleware("http") +async def require_iap(request: Request, call_next): + if not request.headers.get("x-goog-authenticated-user-email"): + return Response(status_code=401, content="Unauthorized") + return await call_next(request) + # ── FIREBASE & FIRESTORE INIT ─────────────────────────────────────────────── db = None try: