Skip to content

refactor: Move auth extractors into authentication module#1547

Open
tpoliaw wants to merge 1 commit into
mainfrom
auth-checks
Open

refactor: Move auth extractors into authentication module#1547
tpoliaw wants to merge 1 commit into
mainfrom
auth-checks

Conversation

@tpoliaw
Copy link
Copy Markdown
Contributor

@tpoliaw tpoliaw commented May 28, 2026

Splitting up the auth extractor method allows other extractors to access the raw token as well as easy access to the validated and decoded access token.

@tpoliaw tpoliaw requested a review from a team as a code owner May 28, 2026 17:30
@codecov
Copy link
Copy Markdown

codecov Bot commented May 28, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.63%. Comparing base (ab2ebc6) to head (3b5b8a2).

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #1547      +/-   ##
==========================================
+ Coverage   95.61%   95.63%   +0.01%     
==========================================
  Files          43       43              
  Lines        3214     3228      +14     
==========================================
+ Hits         3073     3087      +14     
  Misses        141      141              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@tpoliaw tpoliaw changed the base branch from opa-client to main May 29, 2026 10:18
And split the auth check into two so that other methods can access the
raw bearer token if required.
Copy link
Copy Markdown
Contributor

@ZohebShaikh ZohebShaikh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Generally I think why write extra code when it is already been written by someone else ?

Comment on lines +282 to +287
"""Get bearer token value from authorization header"""
auth = req.headers.get("Authorization")
scheme, param = get_authorization_scheme_param(auth)
if scheme.casefold() != "bearer":
return None
return param.strip()
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a copy of this

    authorization = request.headers.get("Authorization")
    scheme, param = get_authorization_scheme_param(authorization)
    if not authorization or scheme.lower() != "bearer":
        if self.auto_error:
            raise self.make_not_authenticated_error()
        else:
            return None  # pragma: nocover
    return param

Why not use the function already in fastAPI ?

After this PR you only use it at 1 more place.
A better thing to do would be to create oauth_scheme in main

oauth_scheme = OAuth2AuthorizationCodeBearer(
    authorizationUrl="",
    tokenUrl="",
    refreshUrl=None,
)

and do depend(oauth_scheme) to get the unchecked_access_token

To a certain extend I get that you want authN related stuff to be in the authentication.py file

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants