Backend abuse controls for the public Cloud Run proxy - #1
Merged
Conversation
/analyze and /chat are public (allUsers run.invoker) and hit paid Vertex AI with no attestation, rate limit, or cost cap. This lands the backend half of the fix without breaking the currently shipped app (which sends no token): - app_check.py: Firebase App Check (Play Integrity) token verification, enforced on /analyze and /chat via a dependency. Gated OFF by default (APP_CHECK_ENABLED=false) so it is a no-op until the app sends tokens. Fails closed if enabled but misconfigured. - pyjwt[crypto] added; Dockerfile copies app_check.py. - tests/test_app_check.py: disabled-passthrough, missing/invalid/valid token, fail-closed, /chat protected, /healthz open. - Fix stale test_app.py assertion (maxOutputTokens 700 -> the live cap). - documentation/12-backend-abuse-controls.md: exposure, mitigations, and the ordered rollout (Firebase/Play setup -> app token header -> flip the flag). Cloud Run --max-instances also capped 100 -> 10 (applied separately) to bound the Vertex cost/quota blast radius. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Lands the backend half of the abuse controls flagged as the remaining production caution after the GCP migration.
/analyzeand/chatare publicly callable (allUsers→roles/run.invoker) and hit paid Vertex AI with no attestation, rate limit, or cost cap.Changes
backend/app_check.py— Firebase App Check (Play Integrity) token verification, enforced on/analyzeand/chat. Gated OFF (APP_CHECK_ENABLED=false), so it's a no-op until the app ships tokens and the flag is flipped — safe to deploy now, won't break the currently shipped app. Fails closed if enabled-but-misconfigured.pyjwt[crypto]dependency; Dockerfile copies the new module.backend/tests/test_app_check.py— disabled-passthrough, missing/invalid/valid token, fail-closed,/chatprotected,/healthzopen. Full suite: 25 passed.test_app.py(maxOutputTokens == 700→ the live cap of 4096 since GCP Backend Migration | /chat Endpoint benevolentbandwidth/ultraprocessed#22).documentation/12-backend-abuse-controls.md— exposure, mitigations, why App Check over the alternatives, and the ordered rollout.Already applied outside this PR (GCP)
--max-instancescapped 100 → 10 (revision-00004) to bound the Vertex cost/quota blast radius. Reversible.Not in this PR — needs Play Console + an app release (see doc 12)
X-Firebase-AppCheckheader (snippet in doc 12).APP_CHECK_ENABLED=true,FIREBASE_PROJECT_NUMBER=894254677159.🤖 Generated with Claude Code