Skip to content

symfonic.platform.transport_production_gate

transport_production_gate

Run the existing production auth gate where the native HTTP surface is assembled.

production_auth_gate (SCOPE-5) moved out of router construction when the native host path was introduced, but nothing on that path called it, so a production process with no verifier built and served while trusting X-Tenant-ID. This runs at assembly and request time, before dispatch. The gate and detect_environment decide.

  • no resolver -- the router trusts the header, which is the posture of a HeaderScopeResolver with no verifier; that is what is gated;
  • a resolver reporting an :class:AuthPosture -- gated against its posture and production process signals, with an explicit override when configured;
  • a resolver without one (prose, or a posture() that raises) -- gated only when the process environment is production, where the gate refuses it with its RuntimeError; development behaviour is unchanged.

gate_native_http_assembly 

gate_native_http_assembly(scope_resolver: Any) -> None

Raise the gate's own error when this assembly must not serve.

Source code in src/symfonic/platform/transport_production_gate.py 
32
33
34
35
36
37
38
39
40
41
def gate_native_http_assembly(scope_resolver: Any) -> None:
    """Raise the gate's own error when this assembly must not serve."""
    in_production = detect_environment() in PRODUCTION_VALUES
    if scope_resolver is None:
        from symfonic.platform.scope import HeaderScopeResolver

        production_auth_gate(HeaderScopeResolver(), force_production=in_production)
        return
    if _reports_auth_posture(scope_resolver) or in_production:
        production_auth_gate(scope_resolver, force_production=in_production)