fix(auth): exempt machine endpoints from global API-key and identity middlewares

tests/test_ingest_auth.py

@@ -126,3 +126,67 @@ def test_knowledge_ingest_accepts_with_service_key(ingest_secured_app):
     assert res.status_code == 200
     assert res.json()["status"] == "rejected"
     assert res.json()["reason_code"] == "security_gate_not_approved"
+
+
+@pytest.fixture
+def machine_layers_app(monkeypatch):
+    """Server posture: global API_KEY + identity enforcement + ingest key.
+
+    Machine endpoints (knowledge-ingest, dispatch inbox) authenticate through
+    their own mandatory ``require_service_api_key`` dependency, so neither the
+    global API_KEY middleware (which only knows the global key) nor the
+    user-identity middleware (machine callers have no X-TeamHub-* headers) may
+    swallow those requests with 401.
+    """
+    monkeypatch.setenv("INGEST_API_KEY", "svc-key")
+    monkeypatch.setenv("API_KEY", "glob-key")
+    monkeypatch.setenv("AUTH_REQUIRE_IDENTITY", "true")
+    import app.config as cfg
+    import app.main as main_module
+
+    cfg.get_settings.cache_clear()
+    importlib.reload(cfg)
+    importlib.reload(main_module)
+    yield main_module.app
+    for _k in ("API_KEY", "INGEST_API_KEY", "AUTH_REQUIRE_IDENTITY"):
+        os.environ.pop(_k, None)
+    cfg.get_settings.cache_clear()
+    importlib.reload(cfg)
+    importlib.reload(main_module)
+
+
+def test_knowledge_ingest_accepts_ingest_key_despite_global_key_and_identity(machine_layers_app):
+    from app.config import settings
+
+    client = TestClient(machine_layers_app)
+    res = client.post(
+        f"{settings.app_api_prefix}/knowledge-ingest",
+        headers={"X-API-Key": "svc-key"},  # ingest key, no identity headers
+        json=_MANIFEST,
+    )
+    assert res.status_code == 200
+    assert res.json()["status"] == "rejected"
+    assert res.json()["reason_code"] == "security_gate_not_approved"
+
+
+def test_machine_endpoints_still_require_their_service_key(machine_layers_app):
+    from app.config import settings
+
+    client = TestClient(machine_layers_app)
+    res = client.post(
+        f"{settings.app_api_prefix}/knowledge-ingest",
+        json=_MANIFEST,  # no key at all
+    )
+    assert res.status_code == 401
+
+
+def test_user_routes_keep_global_key_and_identity_enforcement(machine_layers_app):
+    from app.config import settings
+
+    client = TestClient(machine_layers_app)
+    # A normal (non-machine) API route: the ingest key must NOT unlock it.
+    res = client.get(
+        f"{settings.app_api_prefix}/documents",
+        headers={"X-API-Key": "svc-key"},
+    )
+    assert res.status_code == 401