Make local auth opt-in for dev and expose yt-dlp dependency readiness on /health

[Copilot]

Canonical issue

Linked automatically by canonical-issue workflow.

Outcome

Local FastAPI+Next runs no longer hit auth-driven 503s by default when no API key is set, while production remains fail-closed. /health now exposes concrete readiness signals for yt-dlp-related runtime dependencies.

Scope

• Included:
  • Auth gate defaulting (backend middleware): when EVENTRELAY_API_KEY is unset, non-production defaults to open auth (open_dev); production still returns 503 on protected routes unless explicitly overridden.
  • Health readiness surface: extended /health with explicit dependency flags for import/runtime tool availability:
    • yt_dlp_ready
    • youtube_transcript_api_ready
    • yt_dlp_executable_ready
    • ffmpeg_ready
    • ffprobe_ready
    • aggregate video_path_ready preserved
  • Readiness/auth contract tests: updated unit coverage for env-sensitive auth mode behavior and expanded health payload contract.
  • Developer docs: updated local run guidance to reflect opt-in local auth and the expanded readiness payload.
• Explicitly excluded:
  • Frontend auth middleware behavior
  • API shape changes for /api/v1/health
  • Any production auth policy changes beyond preserving fail-closed semantics

Example payload shape:

{
  "auth_mode": "open_dev",
  "video_deps": {
    "yt_dlp": true,
    "youtube_transcript_api": true,
    "yt_dlp_executable": true,
    "ffmpeg": true,
    "ffprobe": true
  },
  "yt_dlp_executable_ready": true,
  "ffmpeg_ready": true,
  "ffprobe_ready": true,
  "video_path_ready": true
}

Risk

• Risk level: low
• Failure mode: incorrect environment classification could open or close auth unexpectedly for non-public routes.
• Rollback: revert middleware env-default logic and health payload extension in src/youtube_extension/backend/middleware/api_key_auth.py and src/youtube_extension/main.py.

Verification

List exact automated and manual checks, tied to the current head SHA.

• Focused tests
• Required CI
• Review threads resolved

Production evidence

Not applicable for this change set: this PR targets local-dev auth ergonomics and backend health introspection fields; no production behavior expansion beyond existing fail-closed policy.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

• Fixes Opt-in local auth and expose video deps readiness #1351

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Sep 8, 2026 11:58pm UTC

[vercel]

Auth middleware fails OPEN in any non-production environment (including internet-reachable Vercel preview and staging where ENVIRONMENT is unset), exposing all protected endpoints — including DELETE /api/v1/cache — without authentication when EVENTRELAY_API_KEY is not set.

[github-actions]

🔍 PR Validation

⚠️ PR title should follow conventional commits format

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 49e2562.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a60b8d77-00a2-441c-8b97-e5c76bed4e5f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}