harden: secure main.py (multi_agent.cwe-862)

[anupamme]

The /api/enrich/bulk and related enrichment endpoints lack visible authentication middleware. Without explicit authentication checks, these expensive operations can be triggered by unauthenticated attackers. This is defence-in-depth at python-recipes/parallel-investor-signals/project/backend/main.py:273 rather than a vulnerability I can show is exploitable here — it makes the failure mode explicit and bounded. Close it freely if the pattern is intentional.

What changed

• python-recipes/parallel-investor-signals/project/backend/main.py

Verification

No automated check could be run against this repository, so this change is unverified beyond review. Please treat it as a suggestion.

Regression test

The security boundary is maintained under adversarial input

Test

import pytest
from fastapi.testclient import TestClient
import sys
import os

sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'python-recipes', 'parallel-investor-signals', 'project', 'backend'))
from main import app


@pytest.mark.parametrize("endpoint,payload", [
    ("/api/enrich", {"ticker": "AAPL"}),
    ("/api/enrich/bulk", {"tickers": ["AAPL", "MSFT"]}),
    ("/api/enrich/custom", {"ticker": "GOOGL", "fields": ["price"]}),
])
def test_enrichment_endpoints_require_authentication(endpoint, payload):
    """Invariant: Enrichment endpoints must reject unauthenticated requests with 401 Unauthorized."""
    client = TestClient(app)
    response = client.post(endpoint, json=payload)
    assert response.status_code in (401, 403), \
        f"Endpoint {endpoint} must require authentication, got {response.status_code}"

---

Automated security fix by OrbisAI Security