Wire JWT middleware to all FastAPI routes #4

New Issue

2026-04-20T09:34:08Z

sharang commented

2026-04-20 09:34:08 +00:00

Problem

auth/keycloak_auth.py implements Keycloak JWT validation but it is not wired to any route in backend-compliance/compliance/api/. Every endpoint is currently publicly callable without a Bearer token.

Grep confirms: zero uses of Depends(get_current_user) or @require_auth across all API route files.

Required Actions

Create a FastAPI dependency get_current_user in compliance/api/dependencies.py that validates the Bearer token against Keycloak's JWKS endpoint
Add current_user: User = Depends(get_current_user) to every router that is not intentionally public
Public exceptions (health checks, OpenAPI schema) must be explicitly listed
Return 401 for missing/invalid tokens, 403 for valid token with insufficient scope

Files to Change

compliance/api/dependencies.py (create)
Every router file under compliance/api/ (~20 files)
main.py — add global exception handler for auth errors

Acceptance Criteria

curl -X GET https://api-dev.breakpilot.ai/api/v1/compliance/controls returns 401
Authenticated requests with valid Keycloak token succeed
CI test added: test_all_routes_require_auth

## Problem `auth/keycloak_auth.py` implements Keycloak JWT validation but it is not wired to any route in `backend-compliance/compliance/api/`. Every endpoint is currently publicly callable without a Bearer token. Grep confirms: zero uses of `Depends(get_current_user)` or `@require_auth` across all API route files. ## Required Actions 1. Create a FastAPI dependency `get_current_user` in `compliance/api/dependencies.py` that validates the Bearer token against Keycloak's JWKS endpoint 2. Add `current_user: User = Depends(get_current_user)` to every router that is not intentionally public 3. Public exceptions (health checks, OpenAPI schema) must be explicitly listed 4. Return 401 for missing/invalid tokens, 403 for valid token with insufficient scope ## Files to Change - `compliance/api/dependencies.py` (create) - Every router file under `compliance/api/` (~20 files) - `main.py` — add global exception handler for auth errors ## Acceptance Criteria - `curl -X GET https://api-dev.breakpilot.ai/api/v1/compliance/controls` returns 401 - Authenticated requests with valid Keycloak token succeed - CI test added: `test_all_routes_require_auth`

sharang added this to the M1: Security Foundation milestone 2026-04-20 09:34:08 +00:00

sharang added the severity: high security labels 2026-04-20 09:34:08 +00:00

sharang referenced this issue

2026-04-20 09:34:28 +00:00

Fix multi-tenancy bypass: derive tenant_id from JWT, not from request headers #5

sharang referenced this issue

2026-04-20 09:34:50 +00:00

Fix CORS default: restrict allowed origins from wildcard to explicit list #8

sharang referenced this issue

2026-04-20 09:36:29 +00:00

Add DSGVO-required audit logging for all data access and mutation routes #16

sharang referenced this issue