feat(cloud-auth): require production credentials

apps/cloud-api/cloud_api/app.py

@@ -5,7 +5,12 @@ from contextlib import asynccontextmanager
 
 from fastapi import FastAPI
 
-from cloud.control_config import CloudControlConfig, load_control_config
+from cloud.auth import create_auth_provider
+from cloud.control_config import (
+    CloudControlConfig,
+    load_control_config,
+    validate_control_config,
+)
 from cloud.database import CloudDatabase
 
 
@@ -19,13 +24,19 @@ def create_app(
 ) -> FastAPI:
     """Create the independently deployable cloud API application."""
     control_config = config or load_control_config()
+    validate_control_config(control_config)
     build_database = database_factory or _default_database_factory
+    auth_provider = create_auth_provider(
+        control_config.credentials,
+        allow_insecure_anonymous=control_config.allow_insecure_anonymous,
+    )
 
     @asynccontextmanager
     async def lifespan(app: FastAPI):
         database = build_database(control_config)
         app.state.cloud_config = control_config
         app.state.database = database
+        app.state.auth_provider = auth_provider
         try:
             yield
         finally:

apps/cloud-api/tests/test_app.py

@@ -1,9 +1,10 @@
 from __future__ import annotations
 
+import pytest
 from fastapi.testclient import TestClient
 
 from cloud_api.app import create_app
-from cloud.control_config import CloudControlConfig
+from cloud.control_config import CloudConfigurationError, CloudControlConfig
 
 
 def test_create_app_returns_independent_cloud_application() -> None:
@@ -31,3 +32,13 @@ def test_cloud_application_owns_database_lifecycle() -> None:
         assert events == []
 
     assert events == ["closed"]
+
+
+def test_production_app_rejects_missing_credentials() -> None:
+    with pytest.raises(CloudConfigurationError, match="credential"):
+        create_app(
+            config=CloudControlConfig(
+                environment="production",
+                database_url="postgresql://db/cloud",
+            )
+        )