Restrict local API to loopback clients

2026-10-03 14:35:31 +03:00
parent d57efbdca3
commit c1c4ba2ecf
6 changed files with 45 additions and 5 deletions
@@ -9,4 +9,8 @@ from app import auth, database
 def authenticated_client(app: FastAPI) -> TestClient:
    database.ensure_user(database.LOCAL_USER_ID)
    token, _ = auth.issue_session(database.LOCAL_USER_ID)
-    return TestClient(app, headers={"Authorization": f"Bearer {token}"})
+    return TestClient(
+        app,
+        headers={"Authorization": f"Bearer {token}"},
+        client=("127.0.0.1", 8000),
+    )