Merged
Conversation
|
|
||
| # Optional user-context header set by the web app for server-to-server calls. | ||
| # Name is aligned with the frontend's USER_CONTEXT_HEADER. | ||
| user_context_header = headers.get("x-mdb-user-context") or headers.get("md-user-context") |
Contributor
There was a problem hiding this comment.
[question] where is md-user-context used?
Member
Author
There was a problem hiding this comment.
It's not currently in use. It will be used for server-to-server calls that are not from the UI.
cka-y
reviewed
Feb 13, 2026
| value = data.google_project.project.project_id | ||
| } | ||
| env { | ||
| name = "S2S_JWT_SECRET" |
Contributor
There was a problem hiding this comment.
[question] is the secret manually created?
Member
Author
There was a problem hiding this comment.
Yes, this secret is set directly in the environment.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary:
Closes #1578
Related to MobilityData/mobilitydatabase-web#7
This PR adds support for server-to-server authentication.
Expected behavior:
User context is extracted from the request when the HTTP headers the contains the mdb-user-context JWT signed header.
From our AI friend
This pull request introduces support for a custom user-context JWT for server-to-server authentication, allowing the API to securely identify users based on a shared secret. The changes include decoding and verifying the new JWT, updating request context extraction logic, and ensuring the required secret is available in the deployment environment.
Authentication and user context enhancements:
decode_user_context_jwtinrequest_context.pyto decode and verify a custom JWT (x-mdb-user-context) using HS256 and a shared secret (S2S_JWT_SECRET). This method safely falls back to existing identity handling if verification fails._extract_from_headersinrequest_context.pyto extract user information from the custom JWT header, prioritizing verified values and supporting guest users.is_guestattribute to the request context to track guest status, and updated related tests to expect this field.Infrastructure and configuration updates:
main.tfto inject theS2S_JWT_SECRETas an environment variable from a secret manager, ensuring secure access to the shared secret for JWT verification.Dependency management:
base64,hashlib,hmac, andjsoninrequest_context.pyto support JWT decoding and verification.Testing tips:
[internal team]
Please make sure these boxes are checked before submitting your pull request - thanks!
./scripts/api-tests.shto make sure you didn't break anything