Harden production workflows and agent admission

server/monlet_server/middleware/auth.py

@@ -1,22 +1,42 @@
+import hmac
+
 from starlette.middleware.base import BaseHTTPMiddleware
 from starlette.requests import Request
 
+from ..agent_auth import credential_from_token
 from ..errors import error_response
 from ..settings import get_settings
 
 NO_AUTH_PATHS = {"/api/v1/health", "/api/v1/ready", "/metrics"}
 
+AGENT_PATHS = {"/api/v1/heartbeat", "/api/v1/events"}
+
+
+def _match_token(presented: str, accepted: list[str]) -> bool:
+    matched = False
+    # Constant-time across all accepted tokens to avoid timing oracle.
+    for t in accepted:
+        if hmac.compare_digest(presented, t):
+            matched = True
+    return matched
+
 
 class BearerAuthMiddleware(BaseHTTPMiddleware):
     async def dispatch(self, request: Request, call_next):
-        if request.url.path in NO_AUTH_PATHS:
+        path = request.url.path
+        if path in NO_AUTH_PATHS:
             return await call_next(request)
 
-        expected = get_settings().auth_token
         header = request.headers.get("authorization")
         if not header or not header.lower().startswith("bearer "):
             return error_response(request, 401, "unauthorized", "authentication required")
         token = header.split(" ", 1)[1].strip()
-        if token != expected:
-            return error_response(request, 401, "unauthorized", "authentication required")
+
+        if path in AGENT_PATHS:
+            if len(token) < 32 or len(token) > 512:
+                return error_response(request, 401, "unauthorized", "authentication required")
+            request.state.agent_credential = credential_from_token(token)
+        else:
+            if not _match_token(token, get_settings().auth_tokens):
+                return error_response(request, 401, "unauthorized", "authentication required")
         return await call_next(request)