Skip to content

[P0] No authentication middleware on any microservice endpoints

Problem

None of the microservice endpoints in the overlay have authentication middleware. All REST endpoints are publicly accessible to anyone who can reach the service network. This includes destructive operations like file ingestion, retraction, and ingestion kill.

Files

  • dataprep/genieai_dataprep_microservice.py:103-110 — POST /v1/dataprep/ingest_file — no auth
  • dataprep/genieai_dataprep_microservice.py:211-217 — POST /v1/dataprep/kill_ingest — no auth
  • dataprep/genieai_dataprep_microservice.py:246-253 — POST /v1/dataprep/retract_file — no auth
  • retriever/genieai_retriever_microservice.py:69-76 — POST /v1/retrieval — no auth
  • reranker/genieai_reranking_microservice.py:42-49 — POST /v1/reranking — no auth
  • chatqna/genieai_chatqna.py:1572 — POST /v1/chatqna — no auth
  • http-service/test.py:14-15 — GET /get-token — no auth (returns valid JWT)

Acceptance Criteria

  • Implement JWT validation middleware for all microservice endpoints
  • Use the existing http-service auth pattern or shared middleware
  • Ensure destructive endpoints (ingest, retract, kill) require admin role
  • Add authentication to the GET /get-token endpoint itself
  • Document the authentication flow in each service's README