fix(security): allow disabling API docs in production via GATEWAY_ENABLE_DOCS (#2651)

* fix(security): allow disabling API docs in production via GATEWAY_ENABLE_DOCS

Expose /docs, /redoc, and /openapi.json only when GATEWAY_ENABLE_DOCS=true
(default). Setting GATEWAY_ENABLE_DOCS=false disables all three endpoints,
preventing unauthorized API surface discovery in production deployments.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* test(security): add unit tests and docs for GATEWAY_ENABLE_DOCS

Add 7 tests covering default behavior, env var parsing (case-insensitive,
fail-closed), endpoint visibility, and health endpoint independence.
Update CONFIGURATION.md and CLAUDE.md with the new toggle.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* style(security): apply ruff formatting to gateway app.py

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Willem Jiang <willem.jiang@gmail.com>

This commit is contained in:

sunsine

2026-04-30 10:58:32 +08:00

committed by

GitHub

parent f7b10d42e4

commit 0691c4dda3

6 changed files with 134 additions and 4 deletions

									
										.env.example
									
		+3
		
												View File
												
				@@ -40,3 +40,6 @@ INFOQUEST_API_KEY=your-infoquest-api-key

				#

				# WECOM_BOT_ID=your-wecom-bot-id

				# WECOM_BOT_SECRET=your-wecom-bot-secret

				# Set to "false" to disable Swagger UI, ReDoc, and OpenAPI schema in production

				# GATEWAY_ENABLE_DOCS=false