Module management_auth 

Runtime route-scoped chaos rules API Token gate for control-plane writes on a hosted mock (#1085).

A hosted mock serves the customer’s API and MockForge’s own management routes on the same public port. When MOCKFORGE_MANAGEMENT_TOKEN is set (the registry sets it on every hosted machine), any request that can change state on a control-plane route must carry that token. Reads stay open because the cloud UI fetches the spec, route list, docs and live stream straight from the browser. Self-hosted servers don’t set the variable, so nothing changes for them.

Constants

MANAGEMENT_TOKEN_ENV

Environment variable holding the deployment’s management token

MANAGEMENT_TOKEN_HEADER

Header that carries the token (Authorization: Bearer also works)

Functions

gate_control_plane_writes

Wrap app in the token gate when MOCKFORGE_MANAGEMENT_TOKEN is set. Apply it last, after every router is merged, so no route escapes it.

is_control_plane

Whether path belongs to a MockForge control-plane route