Fix authentication bypass in multi-API deployments

[Lidang-Jiang]

Summary

Fixes #659 — When serving multiple APIs via LitServer([api1, api2, ...]), only the first API's authorize() method is checked. Subsequent APIs with custom authorization are left unprotected.

Root cause

setup_auth() always uses self.lit_api (set to the first API at init), ignoring per-API auth methods:

def setup_auth(self):
    if hasattr(self.lit_api, "authorize") and callable(self.lit_api.authorize):
        return self.lit_api.authorize  # ← Always the FIRST API

Fix (3 lines changed)

• setup_auth() now accepts an optional lit_api parameter
• _register_api_endpoints() and _register_spec_endpoints() pass the specific lit_api
• Internal endpoints (/, /health, /info) retain existing behavior

def setup_auth(self, lit_api=None):
    target = lit_api or self.lit_api
    if hasattr(target, "authorize") and callable(target.authorize):
        return target.authorize

Before (unmodified code — 3 new tests all FAIL)

FAILED tests/unit/test_auth.py::test_multi_api_second_api_auth_enforced - assert 200 == 401
FAILED tests/unit/test_auth.py::test_multi_api_mixed_auth - assert 200 == 401
FAILED tests/unit/test_auth.py::test_multi_api_both_with_different_auth - assert 200 == 401
============================== 3 failed in 4.40s ===============================

SecureAPI returns 200 without credentials — auth bypass confirmed.

After (with fix — all 7 tests PASS)

tests/unit/test_auth.py::test_authorized_custom PASSED                   [ 14%]
tests/unit/test_auth.py::test_not_authorized_custom PASSED               [ 28%]
tests/unit/test_auth.py::test_authorized_api_key PASSED                  [ 42%]
tests/unit/test_auth.py::test_not_authorized_api_key PASSED              [ 57%]
tests/unit/test_auth.py::test_multi_api_second_api_auth_enforced PASSED  [ 71%]
tests/unit/test_auth.py::test_multi_api_mixed_auth PASSED                [ 85%]
tests/unit/test_auth.py::test_multi_api_both_with_different_auth PASSED  [100%]

============================== 7 passed in 8.09s ===============================

Full suite: 76 passed, 3 skipped

Test plan

• test_multi_api_second_api_auth_enforced — PublicAPI(no auth) + SecureAPI(auth) → second API properly protected
• test_multi_api_mixed_auth — auth API first, open API second → each works independently
• test_multi_api_both_with_different_auth — two APIs with different tokens → cross-token rejected
• Existing auth tests still pass (4/4)
• ruff check and pre-commit hooks pass

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85%. Comparing base (202f724) to head (3d2c437).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@         Coverage Diff         @@
##           main   #674   +/-   ##
===================================
- Coverage    85%    85%   -0%     
===================================
  Files        39     39           
  Lines      3278   3279    +1     
===================================
- Hits       2774   2773    -1     
- Misses      504    506    +2     

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[bhimrazy]

Thanks @Lidang-Jiang for the fixes.

I also added a minor improvement.