Auditing¶

auth_surface(app) lists every route with what guards it, including routes hidden from the OpenAPI schema:

from fastapi import FastAPI

from fastapi_multiauth import auth_surface


def print_surface(app: FastAPI) -> None:
    for route in auth_surface(app):
        methods = ",".join(route.methods) or "WS"
        flag = "UNGUARDED" if route.unguarded else ""
        print(f"{methods:8} {route.path:30} {flag}")

Each RouteAuth tells you:

unguarded

True when a request without any credential reaches the route.

alternatives

The ways in. Each entry is one way (OR); the schemes inside an entry must all pass (AND).

scopes

Every scope named on the route.

Each SchemeRequirement in alternatives also says whether it refuses cross-origin requests: csrf is False for a cookie source without csrf=True.

To fail CI on an unguarded route, see the audit recipe.