feat(cloud-console): add user authentication and administration

packages/cloud-platform/cloud/sdk/api.py

@@ -10,7 +10,7 @@ authentication can be added later without changing route signatures.
 
 from __future__ import annotations
 
-from typing import TYPE_CHECKING, Literal
+from typing import TYPE_CHECKING, Callable, Literal
 
 from cloud.auth import (
     PLUGINS_ADMIN_SCOPE,
@@ -49,6 +49,7 @@ def create_cloud_router(
     scheduler: "TaskScheduler",
     plugin_registry: "PluginRegistry",
     auth_provider: AuthProvider | None = None,
+    csrf_validator: Callable[[Request, Principal], bool] | None = None,
     version_prefix: str = "/v1",
 ) -> APIRouter:
     """Build the ``/v1`` APIRouter exposing the platform SDK surface."""
@@ -63,11 +64,25 @@ def create_cloud_router(
                 detail="unauthorized",
                 headers={"WWW-Authenticate": "Bearer"},
             )
+        if principal.must_change_password:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="password must be changed before accessing this resource",
+            )
         if not principal.has_scope(required_scope):
             raise HTTPException(
                 status_code=status.HTTP_403_FORBIDDEN,
                 detail=f"missing required scope: {required_scope}",
             )
+        if (
+            principal.session_id is not None
+            and request.method in {"POST", "PUT", "PATCH", "DELETE"}
+            and (csrf_validator is None or not csrf_validator(request, principal))
+        ):
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="CSRF validation failed",
+            )
         return principal
 
     @router.post(