Skip to content

spark_on_k8s.api.remote_auth

Implementation reference. These symbols describe how the project works; their presence here does not make them supported application imports. Use the documented entry points and support policy.

RemoteAccessMiddleware

Remote mode protects every HTTP/WebSocket surface; only liveness remains public.

Source code in spark_on_k8s/api/remote_auth.py 
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
class RemoteAccessMiddleware:
    """Remote mode protects every HTTP/WebSocket surface; only liveness remains public."""

    def __init__(self, app):
        self.app = app

    async def __call__(self, scope, receive, send):
        if scope["type"] not in {"http", "websocket"}:
            return await self.app(scope, receive, send)
        settings = get_submission_settings()
        path = scope["path"]
        root_path = scope.get("root_path", "").rstrip("/")
        if root_path and path.startswith(root_path + "/"):
            path = path[len(root_path) :]
        health = (
            scope["type"] == "http" and path in {"/health", "/ready"} and scope["method"] in {"GET", "HEAD"}
        )
        if settings.enabled and not health:
            values = [value for key, value in scope["headers"] if key.lower() == b"authorization"]
            scheme, _, credential = values[0].partition(b" ") if len(values) == 1 else (b"", b"", b"")
            if scheme.lower() != b"bearer" or not settings.accepts(credential):
                note(code="unauthorized")
                if scope["type"] == "websocket":
                    await send({"type": "websocket.close", "code": 1008})
                else:
                    response = JSONResponse(
                        error_body("unauthorized", "Bearer authentication is required."),
                        status_code=401,
                        headers={"WWW-Authenticate": "Bearer", "Cache-Control": "no-store"},
                    )
                    await response(scope, receive, send)
                return
            scope["spark_on_k8s.remote_authenticated"] = True
        await self.app(scope, receive, send)