Auth Gate Middleware (docker/auth_gate.py)

ASGI middleware that enforces JWT or static token authentication on all routes, providing fail‑closed security and principal injection for FastAPI apps.

# Source: https://github.com/mperkins0155/crawl4ai-cobaltai | License: Apache-2.0
# Provided via justclaw.it.com; keep this notice with the code.
"""
AuthGateMiddleware - the single, fail-closed authentication boundary.

The previous design decided auth in a per-route FastAPI dependency that, when
`jwt_enabled` was false (the default), returned `lambda: None` - so every
`Depends(token_dep)` was decorative and the whole API was open. Static mounts,
the MCP transports and the Prometheus endpoint were never covered at all.

This middleware moves auth to the outermost ASGI layer so it covers EVERY
route, mount and sub-app (HTTP + WebSocket) uniformly, and it fails closed: a
request without a valid credential is rejected before it reaches any handler.

Accepted credentials:
  * the static opera

... (truncated -- full source via MCP)