refactor: split request auth from local owner lookup #365

New issue

Closed

opened 2026-05-11 21:02:06 +00:00 by barrettruth · 0 comments

barrettruth commented

2026-05-11 21:02:06 +00:00

Owner

Parent: #355

Problem

Auth helpers mix local owner creation/lookup, API-key request auth, unauthorized responses, and IP/rate-limit utilities. Some routes intentionally use local owner access while others require request auth, but helper names do not make that boundary obvious.

Solution

Split the auth helper surface by responsibility:

explicit local-owner lookup/bootstrap helper
explicit request API-key auth helper
explicit unauthorized/error response helper where useful
preserve every current route's access semantics

Acceptance criteria

Route code makes local-owner vs request-auth behavior obvious.
No route becomes more or less permissive.
Auth/API tests cover the unchanged behavior.

Parent: #355 ## Problem Auth helpers mix local owner creation/lookup, API-key request auth, unauthorized responses, and IP/rate-limit utilities. Some routes intentionally use local owner access while others require request auth, but helper names do not make that boundary obvious. ## Solution Split the auth helper surface by responsibility: - explicit local-owner lookup/bootstrap helper - explicit request API-key auth helper - explicit unauthorized/error response helper where useful - preserve every current route's access semantics ## Acceptance criteria - Route code makes local-owner vs request-auth behavior obvious. - No route becomes more or less permissive. - Auth/API tests cover the unchanged behavior.

barrettruth added the

track:api

track:core

type:cleanup

labels

2026-05-11 21:02:06 +00:00

barrettruth referenced this issue

2026-05-11 21:02:45 +00:00

tracker: foundation hardening before Google sync #355

barrettruth referenced this issue from a pull request that will close it,

2026-05-11 21:33:00 +00:00

refactor: split request auth from local owner lookup #380