Function _admin_auth_failure

uncommon_route/proxy.py:166–192

Return a 401/403 response when admin endpoints should be blocked. Admin endpoints (connections, providers, spend write, routing-config write, selector write) can mutate API keys and routing behavior. Two policies: * ``UNCOMMON_ROUTE_ADMIN_TOKEN`` is set: require ``Authorization: Bear

(request: Request)

def _admin_auth_failure(request: Request) -> JSONResponse | None:
    """Return a 401/403 response when admin endpoints should be blocked.

    Admin endpoints (connections, providers, spend write, routing-config write, selector write)
    can mutate API keys and routing behavior. Two policies:

      * ``UNCOMMON_ROUTE_ADMIN_TOKEN`` is set: require ``Authorization: Bearer <token>``.
      * Not set: only accept requests from a local client.
    """
    token = os.environ.get(_ADMIN_ENV_VAR, "").strip()
    if token:
        hdr = request.headers.get("authorization", "")
        if hdr.startswith("Bearer ") and hdr[7:].strip() == token:
            return None
        return JSONResponse({"error": f"admin token required (set {_ADMIN_ENV_VAR})"}, status_code=401)
    client_host = getattr(request.client, "host", "") if request.client else ""
    if client_host in _LOCAL_CLIENT_HOSTS:
        return None
    return JSONResponse(
        {
            "error": (
                "admin endpoints require a local client; "
                f"set {_ADMIN_ENV_VAR} to allow remote access"
            )
        },
        status_code=403,
    )


class _SpendReservation: