Pipeline Order
| Order | Middleware | File | Purpose |
|---|
| 1 | Request Tracing | middleware/request_tracing.py | Assign trace_id to every request for debugging and audit |
| 2 | Readiness Gate | middleware/readiness_gate.py | Reject API requests until service bootstrap completes |
| 3 | Token Authentication | middleware/token_auth.py | Extract and validate Bearer / API-key / Application tokens |
| 4 | Setup Enforcer | app/__init__.py (check_setup) | Redirect to setup wizard if not configured |
| 5 | Service Login | app/__init__.py (enforce_service_login) | Require session auth for website routes |
| 6 | Metrics | middleware/metrics.py | Performance metrics collection |
Token Authentication Details
Request → TokenExtractor (Authorization / x-api-key header)
→ JWTValidator (check signature + revocation list)
→ APITokenValidator (lookup model + check expiry)
→ ApplicationTokenValidator (scoped validation)
→ ExemptionRules (public prefix check)
→ Route Handler
Public Route Prefixes (No Auth Required)
/setup — Setup wizard pages/static — Static assets (CSS, JS, images)/health — External health checks/auth/login — Login pages/oauth2 — OAuth2 callback URLs
Route Decorators
| Decorator | Purpose |
|---|
@require_auth | Require valid token (any type) |
@require_token_scope("scope") | Require specific token scope |
@allow_public | Skip authentication for this route |
@admin_required | Require admin role (website routes) |
@permission_required("perm") | Require specific RBAC permission |