feat(cloud-auth): require production credentials

packages/cloud-platform/cloud/auth.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 from dataclasses import dataclass, field
 from hashlib import sha256
 from hmac import compare_digest
+from collections.abc import Iterable
 from typing import Protocol, runtime_checkable
 
 
@@ -106,6 +107,19 @@ class ConfiguredBearerAuthProvider:
         return matched_principal
 
 
+def create_auth_provider(
+    credentials: Iterable[BearerCredential],
+    *,
+    allow_insecure_anonymous: bool,
+) -> AuthProvider:
+    configured = list(credentials)
+    if configured:
+        return ConfiguredBearerAuthProvider(configured)
+    if allow_insecure_anonymous:
+        return NullAuthProvider()
+    return ConfiguredBearerAuthProvider([])
+
+
 def _extract_bearer_token(request: object) -> str | None:
     headers = getattr(request, "headers", None)
     if headers is None: