Middleware And Auth

SPAPS uses middleware for cross-cutting HTTP behavior and dependencies for request-specific identity decisions. That division matters: middleware shapes every response, while dependencies decide whether a route can proceed with a specific application, user, or role.

Middleware Catalog

Middleware	Location	Responsibility
`ResponseEnvelopeMiddleware`	`middleware/envelope.py`	Wrap JSON responses in the standard envelope
`RateLimitMiddleware`	`middleware/rate_limiting.py`	Enforce request limits with memory or Redis-backed stores
`SecurityHeadersMiddleware`	`middleware/security_headers.py`	Attach security headers to responses
`CORSMiddleware`	`spaps_app.py`	Enforce configured browser CORS policy
`RequestLoggingMiddleware`	`middleware.py`	Shared request logging for reusable quickstart apps
`SpapsAuthMiddleware`	`auth/__init__.py`	Reusable SPAPS auth middleware for consumer services

Dependency Catalog

Dependency	Location	Responsibility
`get_application`	`middleware/spaps_deps.py`	Validate application API key and publishable-key constraints
`get_current_user`	`middleware/spaps_deps.py`	Require JWT or local-mode user
`get_optional_user`	`middleware/spaps_deps.py`	Return a user when present without requiring one
`require_admin_user`	`middleware/spaps_deps.py`	Require admin user state
`require_roles`	`rbac/__init__.py`	Build FastAPI role dependencies
`require_role` / `require_any_role`	`api/dependencies.py`	Shared API role helpers

Identity Order

Example


from typing import Annotated
 
from fastapi import Depends
from spaps_server_quickstart.rbac import require_roles
 
 
async def admin_report(
    user: Annotated[object, Depends(require_roles("admin"))],
) -> dict[str, str]:
    return {"user_id": str(user.id)}

Middleware order changes are high-risk. Re-run route and middleware tests after touching envelope, rate limit, security header, or CORS behavior.