fix: keep People API FastAPI dependencies server-owned - #16
Conversation
FastAPI 0.116 treated postponed annotations as query fields, so every protected People route returned 422 and OpenAPI generation failed. Inject PurposeContext and the repository through runtime Depends defaults, split bearer tokens on the first ASCII space, and lock the contract with OpenAPI and source tests. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
State that PurposeContext and the repository port are host-injected Depends values so reviewers can see the FastAPI annotation contract without opening the route module. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Bring the Keyverse authorizer repair onto the current People API head and keep the runtime Depends boundary after the protected-default-branch wording update. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
The repository contract now requires buyer-facing integrity metadata to name foundation PR #8 and include the People API and persistence paths. Refresh hashes so the stacked Keyverse repair stays honest. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
pydantic-core 2.33.2 has no cp314 wheel, and pip check failed on 3.12 because httpx/httpcore require certifi. Use the same Pydantic 2.13.4 and certifi pins already proven by Keyverse authorization CI. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
PR #16 at f4595f1 is a correct People API dependency-ownership repair. It is not merge-ready. Keep it Draft.
Finding
The claimed fix is present and hosted People API Quality is green on this SHA for Python 3.12 and 3.14. app.py has no postponed annotations; routes use runtime Depends defaults; bearer split is split(" ", 1); OpenAPI omits context / request / repository_port as caller fields. Keyverse Authorization Quality and Package are also green. Domain Quality was still pending at review time and is not treated as a reason to stop work.
No blocking defect on the claimed repair.
Residual risk on this exact head
The OpenAPI test is a three-name blacklist, not a published-shape lock. A later FastAPI/Pydantic change that leaked credentials, scheme, or flattened PurposeContext fields would not fail that test. There is also no in-repo HTTP probe that sends attacker query names and asserts the stable 404. Those contract gaps are not merge blockers for this repair, but they are the next test lock.
Merge decision
Do not merge to the protected default branch. Do not retarget until predecessor PRs merge and this exact head, or its successor, receives independent review plus green required checks. PR #7 must not merge at the older red People API head.
Next loop already in flight
The buyer-facing gap after this repair is hire completion: create candidate, retrieve candidate, retrieve hire link, record employment, retrieve employment. That work is on the successor branch from this head and must stay Draft with the same stack-order rule.
Sent by Cursor Automation: Fix Issues
|
Closing as superseded by PR #18. Fresh ancestry proof shows #18 head |
2 participants
What changed
PurposeContextand the repository through runtime FastAPIDependsdefaults instead of postponedAnnotatedparameters.app.pyno longer usesfrom __future__ import annotations, so FastAPI 0.116 cannot treat server-owned context, request, or repository objects as caller query fields.\\x1fstay visible and are rejected.context,request, andrepository_portas caller parameters.This branch starts from the current Keyverse authorizer head (PR #7) and repairs the People API Quality failure on that stack.
Why
On the current PR #7 head, every protected People route returned HTTP 422 and
/openapi.jsonomittedinfobecause FastAPI 0.116 interpreted postponed annotations asquery.context/query.request. That blocks the Keyverse authorizer stack from proving the People API still authorizes correctly after independent scope enforcement.Customer next action
Review this exact-head repair, confirm People API Quality is green on Python 3.12 and 3.14, then use it to replace or update PR #7 before any retarget onto the protected default branch.
Verification already run locally
90 passedinservices/people-api/testsorgmetra_people_apipip checkpassedHonest release boundary
This remains a stacked pre-GA verifier plus People API factory. Discovery/JWKS egress, identity-link lifecycle, live Keyverse conformance, atomic idempotency, and external security review are still release gates. Keep the stack Draft until the foundation and predecessor PRs merge, then retarget and require fresh exact-head review and checks.
Merge
Do not merge until required checks and independent review pass. This change does not bypass branch protection.