[jopemachine]

📚 Stacked PRs

Part of the AppProxy worker Ingress stack (epic BA-8433). Merge in order (bottom-up):

1. 👉 feat(BA-8639): let coordinator subapps require the API secret through a middleware #15906 — feat(BA-8639): let coordinator subapps require the API secret through a middleware ← you are here
2. feat(BA-8443): push ingresses from the coordinator to api-delivery workers #15833 — feat(BA-8443): push ingresses from the coordinator to api-delivery workers
3. feat(BA-8444): add the coordinator client that writes ingresses to Traefik etcd #15893 — feat(BA-8444): export ingresses from the coordinator to Traefik etcd

Resolves #15905 (BA-8639)

Summary

• check_api_secret(request) holds the API secret check that auth_required did inline: X-BackendAI-Token (bare, Bearer, BackendAI) or Authorization: Bearer <JWT signed with the secret>.
• auth_required calls it, so the coordinator's existing handlers accept the same tokens as before.
• New auth_required_middleware calls it too, so a subapp of api_handler class methods, which auth_required cannot wrap because their first argument is self, requires the secret on every route. feat(BA-8443): push ingresses from the coordinator to api-delivery workers #15833 uses it for the coordinator /v2/ingress API.

Test plan

• tests/unit/appproxy/coordinator/api/test_utils.py: each accepted token form passes; a missing token, a wrong token, a JWT signed with another secret and an unsupported method are rejected without reaching the handler
• pants check / pants test on tests/unit/appproxy::

🤖 Generated with Claude Code

[jopemachine]

#15833 attaches auth_required to each handler, so the subapp middleware is no longer used.