Skip to content
Claudio Cabrera
Poultry CRM Operations System
Chapter 2 · Component 2 · 20:00src/core/auth.py

Security Architecture

Zero static credentials — GitHub OIDC, GCP Workload Identity Federation, Firebase JWT, dual-layer IAM

In This Component

A pricing API is a financial instrument. Security is not an afterthought — it is baked into the architecture at every layer. This component walks through the complete trust model, from the GitHub Actions pipeline to the final application role check.

The Trust Chain

Deployment plane (GitHub → GCP):

  • GitHub Actions OIDC token is exchanged for short-lived GCP credentials via Workload Identity Federation
  • No service account key files exist anywhere in the repository or CI pipeline
  • The deploy service account has minimal permissions: Artifact Registry writer, Cloud Run admin, runtime service account user

Runtime plane (Caller → Container):

  1. Cloud Run IAM (layer 1): The service is private. Every request must carry a Google identity token in X-Serverless-Authorization. Requests without it are rejected before the container is reached.
  2. Firebase JWT (layer 2): The FastAPI app independently verifies Authorization: Bearer <firebase_token> — issuer, signature, expiry, and project audience.
  3. Role authorization (layer 3): The verified token must carry a roles custom claim signed by a trusted administrative backend. The application intersects the claim against an allow-list — "ops" or "analyst". No caller can self-assign roles.

Configuration-Enforced Security

Protected environments (staging, production) refuse to start if POULTRY_IDENTITY_PROJECT_ID is empty. auth_required is forced True in non-local environments — there is no configuration flag that silently disables authentication in deployment.