Mark verified Studio identity for privileged routes

app/security/middleware.py

@@ -76,6 +76,7 @@ class APIKeyAuthenticationMiddleware(BaseHTTPMiddleware):
                     logger.warning("rejected Studio identity envelope: %s", str(exc))
                     raise UnauthorizedError from exc
                 principal = await self.api_keys.tenants.resolve_studio_subject(identity.subject)
+                request.state.studio_identity_verified = True
                 try:
                     # The shared key authenticates transport only; persisted
                     # membership capabilities constrain its effective scopes.
@@ -215,91 +216,4 @@ class APIKeyAuthenticationMiddleware(BaseHTTPMiddleware):
                 context,
                 "social_schedule",
                 limit=self.settings.social_schedule_requests_per_minute,
-                window_seconds=60,
-            )
-        elif path.endswith("/reschedule"):
-            await self.rate_limiter.acquire_category(
-                context,
-                "social_schedule",
-                limit=self.settings.social_schedule_requests_per_minute,
-                window_seconds=60,
-            )
-        elif path.endswith("/bulk"):
-            await self.rate_limiter.acquire_category(
-                context,
-                "social_bulk",
-                limit=max(1, self.settings.social_schedule_requests_per_minute // 4),
-                window_seconds=60,
-            )
-
-    @staticmethod
-    def _bearer_token(header: str | None) -> str:
-        if not header:
-            raise UnauthorizedError
-        parts = header.strip().split()
-        if len(parts) != 2 or parts[0].casefold() != "bearer" or not parts[1]:
-            raise UnauthorizedError
-        return parts[1]
-
-    @staticmethod
-    def _content_length(value: str | None) -> int:
-        try:
-            return max(0, int(value or 0))
-        except ValueError:
-            return 0
-
-    @staticmethod
-    def _error(
-        status_code: int,
-        error: str,
-        message: str,
-        request: Request,
-        headers: dict[str, str] | None = None,
-    ) -> JSONResponse:
-        response_headers = dict(headers or {})
-        request_id = getattr(request.state, "request_id", None)
-        if request_id:
-            response_headers["X-Request-ID"] = request_id
-        return JSONResponse(
-            {"error": error, "message": message},
-            status_code=status_code,
-            headers=response_headers,
-        )
-
-    def _client_ip(self, request: Request) -> str | None:
-        if self.settings.auth_trust_proxy_headers:
-            forwarded = request.headers.get("x-forwarded-for")
-            if forwarded:
-                return forwarded.split(",", 1)[0].strip()[:64]
-        return request.client.host[:64] if request.client else None
-
-    async def _audit_request(
-        self,
-        request: Request,
-        context: AuthContext,
-        response_code: int,
-        elapsed_ms: int,
-        bytes_uploaded: int,
-        bytes_downloaded: int,
-    ) -> None:
-        data = {
-            "request_id": getattr(request.state, "request_id", "-"),
-            "api_key_id": context.api_key_id,
-            "key_name": context.key_name,
-            "ip_address": self._client_ip(request),
-            "user_agent": request.headers.get("user-agent", "")[:512] or None,
-            "endpoint": request.url.path,
-            "http_method": request.method,
-            "response_code": response_code,
-            "processing_time_ms": elapsed_ms,
-            "bytes_uploaded": bytes_uploaded,
-            "bytes_downloaded": bytes_downloaded,
-        }
-        try:
-            await self.audit.record(**data)
-        except Exception:
-            logger.exception(
-                "authentication audit persistence failed",
-                extra={"api_key_id": context.api_key_id},
-            )
-        logger.info("authenticated request", extra=data)
+