Finding
In \�ackend/app/api/deps/auth.py:80-88, \get_registered_actor\ wraps \ActorService.register_actor()\ and raises 503 on SQLAlchemy errors. Auth succeeds before registry, so valid tokens are verified, but if actor registry fails, the request fails with 503 instead of succeeding.
Risk
A database outage or registry failure blocks all API access, even for authenticated users with valid tokens. Auth is gated on a side effect (registry write) that is not needed for authorization.
Location
- \�ackend/app/api/deps/auth.py:80-88\ — \get_registered_actor\ fails closed on registry error
Recommendation
Make actor registration best-effort/background. If registry fails, still allow the request through with a degraded actor context. Log the failure for operations but don't block the request.
Severity: Medium
Finding
In \�ackend/app/api/deps/auth.py:80-88, \get_registered_actor\ wraps \ActorService.register_actor()\ and raises 503 on SQLAlchemy errors. Auth succeeds before registry, so valid tokens are verified, but if actor registry fails, the request fails with 503 instead of succeeding.
Risk
A database outage or registry failure blocks all API access, even for authenticated users with valid tokens. Auth is gated on a side effect (registry write) that is not needed for authorization.
Location
Recommendation
Make actor registration best-effort/background. If registry fails, still allow the request through with a degraded actor context. Log the failure for operations but don't block the request.
Severity: Medium