zandClaude Opus 4.8
d8399c312f
documents.py carried a parity copy of the gateway-auth allowlist (_jwt_alg, _forwardable_bearer, _SECRET_PREFIXES) — and it DID drift: the same crafted-alg hardening + exact-JWS tightening had to be applied to both copies. _ai_token now delegates to gateway_auth.ai_bearer(request, server_env=_SERVER_TOKEN_ENV); the ~55 duplicated lines are deleted. One and only one fail-closed allowlist, so a future fix can never land on one copy and miss the other. Tests repointed to the _ai_token delegation surface (crafted-alg no-crash, HS256/secret refused, pk-/ asymmetric forwarded, server-key-first). 67 pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Pytest Unit Tests
Install test dependencies
pip install -r tests-unit/requirements.txt
Run tests
pytest tests-unit/