[thorwhalen]

Sprint review (2026-10-11 → 13) of #23, #24, #27, #29, #31, #33: adversarial review, design review, coverage first.

What this changes

Auth (closes #25). The sprint hardened mk_jwt_middleware (aiohttp), but mk_app only builds Bottle apps, so JWTPlugin is what actually guards a py2http service, and it still had every flaw #24 fixed:

• an expired token, a token with a disallowed alg, or one of the wrong key family escaped as a 500 (only DecodeError was caught);
• the token was echoed back in the 401 body;
• Authorization minus its first 7 characters was taken as the token, whatever the scheme;
• an empty secret was accepted (PyJWT ≥2.10 then fails every request);
• CORS preflight called handler(*args, *kwargs);
• ignore_methods crashed on /openapi (no method_name).

Both now share a framework-free py2http.auth (jwt_algorithms, bearer_token, decode_jwt, key_matches, jwt_decode_kwargs). ApiKeyAuthPlugin and mk_superadmin_middleware refuse an empty key (it let header-less requests through) and compare in constant time; the superadmin middleware raises its 401 rather than returning it. New decode_kwargs= on JWTPlugin and mk_jwt_middleware passes audience/issuer/leeway to jwt.decode (the seam #25 asked for).

Design. service.py was 1266 lines, half of it the sprint's object-dispatch machinery. It now lives in py2http.obj_dispatch and py2http.sizeof (moved verbatim, AST-checked by the reviewer), and every name stays importable from py2http.service. Small cleanups: LRUObjStore.peek, direct quota validation, a redundant ternary. The tests' three copies of a WSGI _post helper are one call_wsgi.

Caller-visible changes (all refusals of unsafe setups)

• JWTPlugin(secret="") with verify=True, JWTPlugin(algorithms="HS256") (a bare string; pass a list), and mixed HMAC + public-key algorithms with verify=True now raise at construction, as mk_jwt_middleware already did after JWT middleware: verify signatures, one algorithm family by default, 401 for every bad token #24.
• ApiKeyAuthPlugin("") / mk_superadmin_middleware("") raise.
• py2http.bottle_plugins no longer imports jwt / abort at module level; import py2http no longer loads jwt or cryptography.

No dependents in the local package fleet use JWTPlugin, ApiKeyAuthPlugin, mk_superadmin_middleware or the moved private names.

Review

An independent adversarial review (Opus) tried 28 hostile tokens, Bearer-prefix variants, request-token leakage between Bottle requests, import cycles, and the verbatim move. Nothing got through. Its findings (a 500 on non-UTF-8 Authorization headers, the mixed-family check firing without verification, no server-side log for key problems) are fixed in the last commit, with tests.

Tests

Characterisation tests were committed first and pass on the unchanged code. Full suite: 211 passed (was 149). Coverage of touched modules: bottle_plugins 22% → 94%, middleware 87% → 100%, default_configs 68% → 82%, new auth 100%, obj_dispatch 97%, sizeof 95%; total 73% → 78%.

🤖 Generated with Claude Code