Question

Windsurf generated an API without any auth, how do I add it afterwards?

Solved · 346 viewsasked last month by dana_ships

The FastAPI backend has 12 endpoints and none check who is calling. Anyone with the URL can list all lessons.

What I’ve tried

Started adding an if not user to each endpoint by hand. Tedious and I already missed two.

Comment

2 answers

Marked as helpful by the asker

olu_backendlast month

Don't do it per endpoint. One dependency, applied to the router:

async def current_user(token: str = Depends(oauth2_scheme)) -> User: ...

router = APIRouter(dependencies=[Depends(current_user)])

Every route under that router now requires auth, including the ones you add next month. Keep a separate router for the two public routes (health, login). Then ask Windsurf to move the endpoints between the two routers; that's a task it does well.

Comment

Two routers now, Windsurf moved everything in one go. The lessons list returns 401 without a token. dana_ships last month

grace_mwlast month

Add a test so a new endpoint can't quietly land on the public router:

PUBLIC = {"/health", "/login", "/docs", "/openapi.json"}

def test_every_route_requires_auth(client):
    for route in app.routes:
        if route.path in PUBLIC or "{" in route.path:
            continue
        assert client.get(route.path).status_code in (401, 405), route.path

Routes with path params need a real id, so test those by hand or with a fixture. When Windsurf adds a 13th endpoint next month, this goes red.

Comment

Added it. It immediately found /export, which Windsurf had put on the public router. dana_ships last month

Keyboard shortcuts

Windsurf generated an API without any auth, how do I add it afterwards?

What I’ve tried

2 answers

Your answer

Windsurf generated an API without any auth, how do I add it afterwards?

What I’ve tried

2 answers

Related

Your answer