Dre

[adyogyy-creator]

Summary by CodeRabbit

• Security

  • Management endpoints now require a configured API credential.
  • Credentials can be supplied through bearer authorization or an API key header.
  • Local or loopback access no longer bypasses authentication.

• Authentication

  • Session validation supports both headers and cookies.
  • Renewed sessions automatically update the session cookie.
  • Authentication errors now return clearer HTTP responses.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 086be31b-8952-412e-801f-a9b8d9317b27

📥 Commits

Reviewing files that changed from the base of the PR and between 4d08dd9 and a05f444.

📒 Files selected for processing (1)

• memanto/app/routes/auth_deps.py

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The authentication dependencies now require configured management credentials, use constant-time credential comparison, distinguish configuration and authentication errors, and retain session validation, renewal, and cookie refresh behavior.

Changes

Authentication dependencies

Layer / File(s)	Summary
Credential and cookie helpers memanto/app/routes/auth_deps.py	Authentication documentation was updated. Backend-specific credential lookup now returns the on-premises placeholder or raises an error when the cloud API key is absent. Cookie helper behavior remains unchanged.
Management authorization memanto/app/routes/auth_deps.py	Management access now requires a configured credential from X-Api-Key or bearer authorization. Missing credentials, invalid credentials, and server misconfiguration produce separate errors. The compatibility wrapper delegates to the updated authorization function.
Session validation and renewal memanto/app/routes/auth_deps.py	Session identity now comes from the validated token payload. Session lookup, renewal, cookie refresh, and mapped session errors remain in place.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: ⚪ Minimal · up to a05f4

No actionable merge-blocking risk remains based on the supplied evidence; the change is merge-ready after normal checks and review.

Possibly related PRs

• moorcheh-ai/memanto#1423: Revises the same management-authentication logic and loopback access behavior.
• moorcheh-ai/memanto#1708: Also updates authentication dependencies, management API-key validation, and session handling.

Suggested reviewers: het0814

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title "Dre" does not describe the authentication and authorization changes in the pull request.	Replace "Dre" with a concise title that identifies the authentication or management authorization changes.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}