GareArc 591048d7c2 feat(openapi): bearer auth pipeline + Layer 0 + per-token rate limit (CE) ...

Bearer auth surface for /openapi/v1/* run-routes:

- OAUTH_BEARER_PIPELINE (renamed from APP_PIPELINE for clarity outside this
  module) composes BearerCheck → ScopeCheck → AppResolver →
  WorkspaceMembershipCheck → AppAuthzCheck → CallerMount.
- BearerAuthenticator.authenticate() is the single source of identity +
  rate-limit. Both pipeline (BearerCheck) and decorator (validate_bearer)
  delegate to it, so per-token rate limit fires exactly once per request.
- Layer 0 (workspace membership) is CE-only; on EE the gateway owns
  tenant isolation. Verdicts are cached on the AuthContext entry as
  verified_tenants: dict[str, bool] (legacy "ok"/"denied" strings tolerated
  by from_cache for one TTL cycle, then removed).
- check_workspace_membership(...) is the shared core; the pipeline step
  and the inline require_workspace_member helper both delegate to it.
- Per-token rate limit: 60/min sliding window, RFC-7231-compliant 429
  with Retry-After header + JSON body { error, retry_after_ms }. Bucket
  key is sha256(token) so all replicas share state via Redis.

API hygiene:
- Scope StrEnum (FULL, APPS_READ, APPS_RUN) replaces bare string literals.
- /openapi/v1/apps/<id>/info: scope flipped from apps:run to apps:read.
- /info migrates off the pipeline to validate_bearer + require_scope +
  require_workspace_member (no AppAuthzCheck/CallerMount needed for reads).
- ResolvedRow gains to_cache() / from_cache() classmethods.
- AuthContext gains token_hash + verified_tenants, dropping the per-route
  re-hash and per-request Redis read on the cache hit path.

OPENAPI_RATE_LIMIT_PER_TOKEN config (default 60).

2026-05-05 18:07:47 -07:00

..

__init__.py

feat(openapi): bearer auth pipeline + Layer 0 + per-token rate limit (CE)

2026-05-05 18:07:47 -07:00

composition.py

feat(openapi): bearer auth pipeline + Layer 0 + per-token rate limit (CE)

2026-05-05 18:07:47 -07:00

context.py

feat(openapi): bearer auth pipeline + Layer 0 + per-token rate limit (CE)

2026-05-05 18:07:47 -07:00

pipeline.py

feat(openapi): bearer auth pipeline + Layer 0 + per-token rate limit (CE)

2026-05-05 18:07:47 -07:00

steps.py

feat(openapi): bearer auth pipeline + Layer 0 + per-token rate limit (CE)

2026-05-05 18:07:47 -07:00

strategies.py

feat(openapi): bearer auth pipeline + Layer 0 + per-token rate limit (CE)

2026-05-05 18:07:47 -07:00