Forward session bearer authorization

Forward valid incoming bearer authorization to the fixed session allocator upstream. Missing and non-bearer credentials remain omitted. Includes regression coverage.

README.md

@@ -30,4 +30,5 @@ Optional:
 - `GET /ready`: readiness; fails if the upstream URL is missing or invalid
 - `GET /session-url`: returns the currently configured upstream allocator URL
 - `GET /config`: alias for `/session-url`
-- `POST /session`: proxies the session allocation request to the upstream URL
+- `POST /session`: proxies the session allocation request to the upstream URL,
+  including a valid incoming bearer `Authorization` header when present

app.py

@@ -60,6 +60,25 @@ def _no_store_headers() -> dict[str, str]:
     return {"Cache-Control": "no-store"}
 
 
+def _bearer_authorization(value: str | None) -> str | None:
+    scheme, separator, token = (value or "").partition(" ")
+    token = token.strip()
+    if not separator or scheme.lower() != "bearer" or not token:
+        return None
+    return f"Bearer {token}"
+
+
+def _upstream_headers(request: Request) -> dict[str, str]:
+    headers = {"X-Reachy-Mini-Realtime-URL": "1"}
+    forwarded_headers = {
+        "Content-Type": request.headers.get("content-type"),
+        "Accept": request.headers.get("accept"),
+        "Authorization": _bearer_authorization(request.headers.get("authorization")),
+    }
+    headers.update({name: value for name, value in forwarded_headers.items() if value})
+    return headers
+
+
 def _not_configured_response() -> JSONResponse:
     return JSONResponse(
         {
@@ -144,13 +163,7 @@ async def create_session(request: Request) -> Response:
         return _not_configured_response()
 
     body = await request.body()
-    headers = {"X-Reachy-Mini-Realtime-URL": "1"}
-    content_type = request.headers.get("content-type")
-    if content_type:
-        headers["Content-Type"] = content_type
-    accept = request.headers.get("accept")
-    if accept:
-        headers["Accept"] = accept
+    headers = _upstream_headers(request)
 
     try:
         async with httpx.AsyncClient(timeout=config.timeout_s) as client:

tests/test_session_proxy.py

@@ -0,0 +1,105 @@
+import os
+import unittest
+from unittest.mock import patch
+
+from fastapi import Request
+
+import app as proxy_app
+
+
+class FakeUpstreamResponse:
+    content = b'{"session_id":"session-1"}'
+    status_code = 200
+    headers = {"content-type": "application/json"}
+
+
+class FakeAsyncClient:
+    posts: list[dict[str, object]] = []
+
+    def __init__(self, *, timeout: float):
+        self.timeout = timeout
+
+    async def __aenter__(self):
+        return self
+
+    async def __aexit__(self, exc_type, exc, traceback):
+        return False
+
+    async def post(self, url: str, *, content: bytes, headers: dict[str, str]):
+        self.posts.append(
+            {
+                "url": url,
+                "content": content,
+                "headers": headers,
+                "timeout": self.timeout,
+            }
+        )
+        return FakeUpstreamResponse()
+
+
+def request_with_headers(headers: dict[str, str]) -> Request:
+    encoded_headers = [
+        (name.lower().encode("ascii"), value.encode("ascii"))
+        for name, value in headers.items()
+    ]
+    body_sent = False
+
+    async def receive():
+        nonlocal body_sent
+        if body_sent:
+            return {"type": "http.disconnect"}
+        body_sent = True
+        return {"type": "http.request", "body": b"{}", "more_body": False}
+
+    return Request(
+        {
+            "type": "http",
+            "method": "POST",
+            "path": "/session",
+            "headers": encoded_headers,
+        },
+        receive,
+    )
+
+
+class SessionProxyTests(unittest.IsolatedAsyncioTestCase):
+    def setUp(self):
+        FakeAsyncClient.posts = []
+
+    async def proxy(self, headers: dict[str, str]) -> dict[str, object]:
+        request = request_with_headers(headers)
+        with (
+            patch.dict(
+                os.environ,
+                {proxy_app.UPSTREAM_ENV_NAME: "https://allocator.example/session"},
+            ),
+            patch.object(proxy_app.httpx, "AsyncClient", FakeAsyncClient),
+        ):
+            response = await proxy_app.create_session(request)
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(len(FakeAsyncClient.posts), 1)
+        return FakeAsyncClient.posts[0]
+
+    async def test_forwards_bearer_authorization_to_upstream(self):
+        post = await self.proxy(
+            {
+                "Authorization": "Bearer hf_user_token",
+                "Content-Type": "application/json",
+                "Accept": "application/json",
+            }
+        )
+
+        self.assertEqual(post["headers"]["Authorization"], "Bearer hf_user_token")
+        self.assertEqual(post["headers"]["Content-Type"], "application/json")
+        self.assertEqual(post["headers"]["Accept"], "application/json")
+        self.assertEqual(post["headers"]["X-Reachy-Mini-Realtime-URL"], "1")
+
+    async def test_omits_authorization_when_request_has_no_token(self):
+        post = await self.proxy({})
+
+        self.assertNotIn("Authorization", post["headers"])
+
+    async def test_does_not_forward_non_bearer_authorization(self):
+        post = await self.proxy({"Authorization": "Basic credentials"})
+
+        self.assertNotIn("Authorization", post["headers"])