Split from #654 (architecture-invariant drift). #654 now tracks INV-14 (model centralization, done in #1308); this issue carves out INV-8 because it is security-sensitive and needs new abstractions + a security review, not a mechanical move.
Invariant
#8 — Auth Pattern: every authenticated endpoint uses Depends(get_current_user); agent-scoped endpoints use AuthorizedAgent / OwnedAgentByName; role-gated endpoints use require_role(...) / require_admin. Duplicated/inline auth wiring should collapse behind these shared dependencies (threshold: ≤5 bespoke sites).
Ground truth (re-measured 2026-06-22)
The 2026-05-05 automated report undercounted ("51 sites / 19 files"). Actual:
- 64 sites across 22 files (threshold ≤5).
- Breakdown: ~27 mechanical (swap to the existing dependency), ~22 need a new auth factory (no current shared helper fits), ~15 inline checks to fold in.
slack.py carries 8 sites — overlaps the channel-adapter area (Pavlo); coordinate before touching.
Why this is its own issue (security-relevant)
- ~22 sites need new auth-factory design — getting the boundary wrong is a privilege/authz risk.
- Requires behavioral verification + a security pass (CSO-style): confirm each consolidated site enforces the same owner/admin/role/agent-scope check it did before. INV-8 is the security-relevant invariant of the original drift report; do not fold it into a mechanical PR.
Suggested approach
- Design the missing auth factories first (cover the ~22 gap cases).
- Migrate the ~27 mechanical sites + ~15 inline checks.
- Coordinate
slack.py with the channel owner.
- CSO/security review of the consolidated boundaries.
Refs: parent #654, sibling #1309 (INV-7), completed INV-14 PR #1308.
Split from #654 (architecture-invariant drift). #654 now tracks INV-14 (model centralization, done in #1308); this issue carves out INV-8 because it is security-sensitive and needs new abstractions + a security review, not a mechanical move.
Invariant
#8 — Auth Pattern: every authenticated endpoint uses
Depends(get_current_user); agent-scoped endpoints useAuthorizedAgent/OwnedAgentByName; role-gated endpoints userequire_role(...)/require_admin. Duplicated/inline auth wiring should collapse behind these shared dependencies (threshold: ≤5 bespoke sites).Ground truth (re-measured 2026-06-22)
The 2026-05-05 automated report undercounted ("51 sites / 19 files"). Actual:
slack.pycarries 8 sites — overlaps the channel-adapter area (Pavlo); coordinate before touching.Why this is its own issue (security-relevant)
Suggested approach
slack.pywith the channel owner.Refs: parent #654, sibling #1309 (INV-7), completed INV-14 PR #1308.