Audit your routes¶

A test that fails when a route can be reached without a credential, hidden routes included:

from fastapi_multiauth import auth_surface

from .sessions_and_tokens import app

PUBLIC = {"/login"}


def test_no_unguarded_routes():
    unguarded = [
        f"{','.join(route.methods) or 'WS'} {route.path}"
        for route in auth_surface(app)
        if route.unguarded and route.path not in PUBLIC
    ]
    assert not unguarded, unguarded

When someone adds a route and forgets to protect it, CI fails until the route gets a guard or is added to PUBLIC on purpose. See Auditing for what auth_surface reports.