@ngocsangairvds/vsaf 3.2.16 → 4.0.0

package/tools/vds-scripts/scheduler_orchestrator/src/vds_scheduler_orchestrator/scheduler/state_pg.py

@@ -1,55 +0,0 @@
-"""
-state_pg.py — Postgres-backed ScheduleStateWriter.
-
-Extracted from ``_write_last_run_at()`` at schedules.py:701-734 (Phase 216 W1).
-Identical SQL UPDATE, identical session-ownership logic.
-"""
-
-from __future__ import annotations
-
-import structlog
-from sqlalchemy import text
-from sqlalchemy.orm import Session
-
-from vds_scheduler_orchestrator.scheduler.schedules import _make_session
-
-log = structlog.get_logger(__name__)
-
-
-class PgScheduleStateWriter:
-    """Postgres impl of ScheduleStateWriter via SQLAlchemy Session."""
-
-    def __init__(self, session: Session | None = None) -> None:
-        self._session = session
-        self._owns = session is None
-
-    def record_last_run(self, schedule_name: str) -> None:
-        """UPDATE sched.schedules.last_run_at = now() WHERE schedule_name = :name.
-
-        Session lifecycle mirrors the original _write_last_run_at():
-        creates a session if none was injected, commits on success,
-        rolls back on failure, closes if self-owned.
-        """
-        session: Session
-        session = self._session if self._session is not None else _make_session()
-
-        try:
-            session.execute(
-                text(
-                    """
-                    UPDATE sched.schedules
-                       SET last_run_at = now(),
-                           updated_at  = now()
-                     WHERE schedule_name = :name
-                    """
-                ),
-                {"name": schedule_name},
-            )
-            session.commit()
-            log.debug("schedule.last_run_at.written", schedule_name=schedule_name)
-        except Exception:
-            session.rollback()
-            raise
-        finally:
-            if self._owns:
-                session.close()

package/tools/vds-scripts/scheduler_orchestrator/src/vds_scheduler_orchestrator/scheduler/state_ports.py

@@ -1,23 +0,0 @@
-"""
-state_ports.py — Abstract port for persisting schedule last-run timestamps.
-
-Implements the DIP half of ADR-90: ``wrap_with_last_run_at_writeback`` depends
-on this Protocol, not on SQLAlchemy.  Postgres impl in ``state_pg.py``.
-In-memory/test-double impl in ``tests/scheduler/conftest.py``.
-"""
-
-from __future__ import annotations
-
-from typing import Protocol
-
-
-class ScheduleStateWriter(Protocol):
-    """Persist the last-run timestamp for a schedule after a successful tick."""
-
-    def record_last_run(self, schedule_name: str) -> None:
-        """Write ``last_run_at = now()`` for *schedule_name*.
-
-        Called AFTER the workflow returns success.  Must NOT be called on
-        failure — the wrapper in ``writeback.py`` enforces this contract.
-        """
-        ...

package/tools/vds-scripts/scheduler_orchestrator/src/vds_scheduler_orchestrator/scheduler/writeback.py

@@ -1,153 +0,0 @@
-"""
-writeback.py — Higher-order wrapper for persisting last_run_at after success.
-
-Implements ADR-90 (Open/Closed Principle decorator):
-Extracts + generalises the Phase 216 W1 ``_cron_dispatch_wf`` pattern
-(``schedules.py:802-824``) into a reusable wrapper that is:
-  - schedule-name-parameterised
-  - writer-port-injected (DIP via ``state_ports.ScheduleStateWriter``)
-  - free of cron/timing concern (SRP boundary)
-
-FR-220.W.1, FR-220.W.5, FR-220.W.6, FR-220.W.7.
-"""
-
-from __future__ import annotations
-
-import asyncio
-import uuid
-from collections.abc import Callable
-from datetime import UTC, datetime
-from typing import Any
-
-import structlog
-
-from vds_scheduler_orchestrator.scheduler.state_ports import ScheduleStateWriter
-
-log = structlog.get_logger(__name__)
-
-# ── Global registry of wrapped schedule names ────────────────────────────────
-# Populated by wrap_with_last_run_at_writeback() at import/bootstrap time.
-# Used by _check_strict_registration() (app.py) since DBOS.list_schedules()
-# returns workflow_name strings, not callables, so is_writeback_wrapped()
-# cannot inspect function attributes from the DBOS TypedDict output.
-_WRAPPED_SCHEDULE_NAMES: set[str] = set()
-
-
-def get_wrapped_schedule_names() -> frozenset[str]:
-    """Return the immutable set of schedule names that have been writeback-wrapped."""
-    return frozenset(_WRAPPED_SCHEDULE_NAMES)
-
-
-def _clear_wrapped_schedule_names() -> None:
-    """Reset the global wrapped-schedule-name registry (test-only)."""
-    _WRAPPED_SCHEDULE_NAMES.clear()
-
-
-def wrap_with_last_run_at_writeback(
-    workflow_fn: Callable[..., Any],
-    schedule_name: str,
-    writer: ScheduleStateWriter,
-) -> Callable[..., Any]:
-    """Wrap a DBOS workflow so ``last_run_at`` is persisted on success only.
-
-    Args:
-        workflow_fn:  The @DBOS.workflow()-decorated callable to wrap.
-        schedule_name:  PK of the ``sched.schedules`` row.
-        writer:  Any ``ScheduleStateWriter`` impl (Postgres, in-memory, etc.).
-
-    Returns:
-        A callable with the same signature as *workflow_fn* that:
-          1. invokes the original workflow
-          2. on success: calls ``writer.record_last_run(schedule_name)``
-             and logs ``scheduler.writeback.recorded``
-          3. on failure: does NOT call writer (last_run_at unchanged)
-
-    The caller must ensure *writer* is long-lived enough to survive the
-    workflow's lifetime.  For Postgres, bind the writer to DBOS's pool or
-    pass ``session=`` at call time.
-
-    This wrapper is stateless — it can be composed at registration time
-    without creating closures over mutable state.
-    """
-
-    def wrapped(*args: Any, **kwargs: Any) -> Any:
-        run_id = str(uuid.uuid4())
-        ran_at: str | None = None
-
-        try:
-            result = workflow_fn(*args, **kwargs)
-            # If the workflow is async, we'll be unwrapped by the DBOS
-            # scheduler, so the return here is either:
-            #   a) sync return value (direct call / test)
-            #   b) coroutine (DBOS fires it via its own event loop)
-            if asyncio.iscoroutine(result):
-
-                async def _await_and_writeback(coro: Any) -> Any:
-                    nonlocal ran_at
-                    try:
-                        inner = await coro
-                    except Exception:
-                        raise  # don't write back on failure
-                    ran_at = datetime.now(UTC).isoformat()
-                    writer.record_last_run(schedule_name)
-                    log.info(
-                        "scheduler.writeback.recorded",
-                        schedule_name=schedule_name,
-                        run_id=run_id,
-                        ran_at=ran_at,
-                    )
-                    return inner
-
-                return _await_and_writeback(result)
-
-            # Sync path
-            ran_at = datetime.now(UTC).isoformat()
-            writer.record_last_run(schedule_name)
-            log.info(
-                "scheduler.writeback.recorded",
-                schedule_name=schedule_name,
-                run_id=run_id,
-                ran_at=ran_at,
-            )
-            return result
-
-        except Exception:
-            # FR-220.W.5: failure → last_run_at unchanged
-            log.debug(
-                "scheduler.writeback.skipped_on_failure",
-                schedule_name=schedule_name,
-                run_id=run_id,
-            )
-            raise
-
-    # Preserve metadata for introspection + strict-registration check
-    wrapped.__name__ = workflow_fn.__name__  # type: ignore[attr-defined]
-    wrapped.__qualname__ = workflow_fn.__qualname__  # type: ignore[attr-defined]
-    wrapped._vds_writeback_wrapped = True  # type: ignore[attr-defined]
-    wrapped._vds_schedule_name = schedule_name  # type: ignore[attr-defined]
-
-    # ADR-DCP-2 (vds-scheduler v0.4.0):
-    # DBOS.create_schedule() validates workflow_fn via get_dbos_func_name(f),
-    # which raises DBOSWorkflowFunctionNotFoundError unless the callable has
-    # the `dbos_function_name` attribute set by @DBOS.workflow(). Without this
-    # propagation, every cron registration raises at runtime; unit tests miss
-    # the bug because they mock DBOS.create_schedule. Preserving the
-    # attribute lets DBOS recognise the wrapper as an alias for the
-    # underlying registered workflow and store the schedule against the
-    # canonical name. (Writeback semantic at cron-tick time is a separate
-    # design issue — DBOS dispatches by name to the underlying registered
-    # function, bypassing this wrapper; tracked as a follow-up.)
-    if hasattr(workflow_fn, "dbos_function_name"):
-        wrapped.dbos_function_name = workflow_fn.dbos_function_name  # type: ignore[attr-defined]
-
-    _WRAPPED_SCHEDULE_NAMES.add(schedule_name)
-
-    return wrapped
-
-
-def is_writeback_wrapped(fn: Callable[..., Any]) -> bool:
-    """Return True if *fn* was wrapped via ``wrap_with_last_run_at_writeback``.
-
-    Used by the strict-registration guardrail (FR-220.W.4).
-    """
-    return getattr(fn, "_vds_writeback_wrapped", False) is True

package/tools/vds-scripts/scheduler_orchestrator/src/vds_scheduler_orchestrator/security/__init__.py

@@ -1 +0,0 @@
-"""security — Capability-based publish control and payload secret scanning (TSK-7.x)."""

package/tools/vds-scripts/scheduler_orchestrator/src/vds_scheduler_orchestrator/security/audit_log.py

@@ -1,238 +0,0 @@
-"""
-audit_log.py — Append-only audit-log emission (ADR-19, TSK-N.7).
-
-Every mutation to sched.* objects (schedules, chains, subscriptions, capabilities)
-MUST call emit() after the change is committed. Capability violations call
-emit_violation() before re-raising CapabilityError.
-
-The sched.audit_log table is append-only at the Postgres role level:
-  vds_scheduler_app has INSERT only — UPDATE + DELETE are REVOKED
-  (migration c3d4e5f6a7b8).
-
-Design principles:
-  - emit() NEVER raises — audit failure is caught and logged at WARNING level,
-    then swallowed. Audit integrity is enforced by Postgres grants, not the app.
-  - Session ownership: if session=None, emit() creates its own session and commits
-    immediately (each emit is its own mini-transaction). If a session is provided,
-    emit() uses it WITHOUT committing — the caller owns the transaction lifecycle.
-    This allows batching multiple audit entries in a single transaction when needed.
-  - trace_id: auto-populated from workflow_trace_context.current_trace_id() if not supplied.
-    Pass an explicit value only when the contextvar is not set (e.g. CLI one-shots).
-  - before_state/after_state: pass None for operations where the delta is not
-    meaningful (e.g. trigger_now, capability check-pass). Always pass both for
-    create/update/delete operations.
-
-Usage:
-    from vds_scheduler_orchestrator.security.audit_log import emit, emit_violation
-
-    # After a successful schedule creation:
-    emit(
-        actor_capability="audit_orchestrator",
-        operation="schedule.create",
-        object_type="schedule",
-        object_id=schedule_name,
-        after_state={"owner": "audit_orchestrator", "kind": "cron"},
-    )
-
-    # Before re-raising CapabilityError:
-    emit_violation(
-        actor_capability="memory_orchestrator",
-        operation="schedule.delete",
-        object_type="schedule",
-        object_id=schedule_name,
-    )
-"""
-
-from __future__ import annotations
-
-import contextlib
-import json
-import uuid
-from datetime import UTC, datetime
-from typing import Any
-
-import structlog
-from sqlalchemy import text
-from sqlalchemy.orm import Session
-
-from vds_scheduler_orchestrator.observability.workflow_trace_context import current_trace_id
-
-log = structlog.get_logger(__name__)
-
-
-# ── Public API ────────────────────────────────────────────────────────────────
-
-
-def emit(
-    actor_capability: str,
-    operation: str,
-    object_type: str,
-    object_id: str,
-    *,
-    before_state: dict[str, Any] | None = None,
-    after_state: dict[str, Any] | None = None,
-    trace_id: str | None = None,
-    session: Session | None = None,
-) -> str | None:
-    """Insert one row into sched.audit_log.
-
-    Args:
-        actor_capability: VDS_SCHEDULER_CAPABILITY of the calling process.
-        operation:        Dotted operation name (e.g. 'schedule.create',
-                          'subscription.delete', 'schedule.pause.violation').
-        object_type:      Object class: 'schedule' | 'chain' | 'subscription' |
-                          'capability'.
-        object_id:        Primary identifier of the mutated object (schedule_name,
-                          chain_name, subscription_id UUID string, etc.).
-        before_state:     JSONB snapshot of the object before the mutation.
-                          Pass None when before-state is not applicable.
-        after_state:      JSONB snapshot of the object after the mutation.
-                          Pass None when after-state is not applicable (violations).
-        trace_id:         Correlation ID. Auto-populated from the tracing contextvar
-                          if not provided.
-        session:          SQLAlchemy ORM Session. If None, a fresh session is created
-                          from the scheduler config and committed immediately.
-                          If provided, the INSERT is executed but NOT committed —
-                          the caller owns commit/rollback.
-
-    Returns:
-        The audit_id (UUID string) of the inserted row, or None on failure.
-
-    Never raises — audit failure is logged at WARNING and swallowed so that
-    audit-log unavailability does not crash business-logic operations.
-    """
-    resolved_trace_id = trace_id or current_trace_id()
-    audit_id = str(uuid.uuid4())
-
-    if session is None:
-        session = _make_session()
-        _owns_session = True
-    else:
-        _owns_session = False
-
-    try:
-        assert session is not None  # guaranteed by if/else above; silences type-checkers
-        session.execute(
-            text(
-                "INSERT INTO sched.audit_log "
-                "(audit_id, actor_capability, operation, object_type, object_id, "
-                " before_state, after_state, trace_id, occurred_at) "
-                "VALUES (:audit_id, :actor_capability, :operation, :object_type, :object_id, "
-                "        CAST(:before_state AS jsonb), CAST(:after_state AS jsonb), "
-                "        :trace_id, :occurred_at)"
-            ),
-            {
-                "audit_id": audit_id,
-                "actor_capability": actor_capability,
-                "operation": operation,
-                "object_type": object_type,
-                "object_id": object_id,
-                "before_state": json.dumps(before_state) if before_state is not None else None,
-                "after_state": json.dumps(after_state) if after_state is not None else None,
-                "trace_id": resolved_trace_id,
-                "occurred_at": datetime.now(UTC),
-            },
-        )
-        if _owns_session:
-            session.commit()
-
-        log.debug(
-            "audit_log.emitted",
-            audit_id=audit_id,
-            operation=operation,
-            object_type=object_type,
-            object_id=object_id,
-            actor_capability=actor_capability,
-        )
-        return audit_id
-
-    except Exception as exc:
-        log.warning(
-            "audit_log.emit_failed",
-            operation=operation,
-            object_type=object_type,
-            object_id=object_id,
-            actor_capability=actor_capability,
-            error=str(exc),
-        )
-        if _owns_session and session is not None:
-            with contextlib.suppress(Exception):
-                session.rollback()
-        return None
-
-    finally:
-        if _owns_session and session is not None:
-            with contextlib.suppress(Exception):
-                session.close()
-
-
-def emit_violation(
-    actor_capability: str,
-    operation: str,
-    object_type: str,
-    object_id: str,
-    *,
-    trace_id: str | None = None,
-    session: Session | None = None,
-) -> str | None:
-    """Emit an audit-log entry for a rejected capability violation.
-
-    Callers MUST still raise CapabilityError after this call — emit_violation()
-    only writes the log entry and returns. It does NOT raise.
-
-    The operation name is suffixed with '.violation' in the audit log so that
-    violation events can be queried separately from successful mutations:
-        SELECT * FROM sched.audit_log WHERE operation LIKE '%.violation'
-
-    Args:
-        actor_capability: The capability that attempted the operation.
-        operation:        The operation that was rejected (e.g. 'schedule.delete').
-                          Stored as '{operation}.violation' in the log.
-        object_type:      Object class being mutated.
-        object_id:        Primary identifier of the target object.
-        trace_id:         Correlation ID (auto-populated from contextvars).
-        session:          SQLAlchemy Session (optional — if None, creates own).
-
-    Returns:
-        audit_id of the inserted row, or None on failure.
-    """
-    return emit(
-        actor_capability=actor_capability,
-        operation=f"{operation}.violation",
-        object_type=object_type,
-        object_id=object_id,
-        before_state={
-            "violation": True,
-            "rejected_operation": operation,
-            "actor": actor_capability,
-        },
-        after_state=None,
-        trace_id=trace_id,
-        session=session,
-    )
-
-
-# ── Session factory (lazy import — avoids circular import at module load) ─────
-
-
-def _make_session() -> Session:
-    """Create a fresh SQLAlchemy ORM session using the scheduler config.
-
-    Lazy-imports config and SQLAlchemy to avoid circular-import issues at
-    module load time (audit_log is imported by security/__init__.py which is
-    imported early in the module graph).
-
-    Raises:
-        RuntimeError: If DATABASE_URL is not set.
-    """
-    from sqlalchemy import create_engine
-    from sqlalchemy.orm import sessionmaker
-
-    from vds_scheduler_orchestrator.config import get_config
-
-    cfg = get_config()
-    if not cfg.vds_scheduler_database_url:
-        raise RuntimeError("DATABASE_URL is not set — cannot emit audit log without a database connection")
-    engine = create_engine(cfg.vds_scheduler_database_url, pool_pre_ping=True)
-    factory = sessionmaker(bind=engine, expire_on_commit=False)
-    return factory()

package/tools/vds-scripts/scheduler_orchestrator/src/vds_scheduler_orchestrator/security/auth.py

@@ -1,49 +0,0 @@
-"""FastAPI dependency for API-key authentication (TSK-N.63)."""
-
-from __future__ import annotations
-
-import hmac
-from typing import Annotated
-
-from fastapi import Header, HTTPException, Request, status
-
-from vds_scheduler_orchestrator.config import get_config
-
-
-async def require_api_key(
-    request: Request,
-    x_vds_scheduler_key: Annotated[str | None, Header(alias="X-VDS-Scheduler-Key")] = None,
-) -> None:
-    """FastAPI dependency: validates API key for /api/v1/* routes.
-
-    No-op when auth_required=False (backward compatible default).
-    When enabled, checks configured header value(s) with constant-time comparison.
-    Dual-key rotation: primary checked first, then old_key if primary fails.
-    """
-    cfg = get_config()
-    if not cfg.vds_scheduler_auth_required:
-        return
-
-    if x_vds_scheduler_key is None:
-        raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Missing API key",
-            headers={"WWW-Authenticate": "Bearer"},
-        )
-
-    api_key = cfg.vds_scheduler_api_key
-    api_key_old = cfg.vds_scheduler_api_key_old
-
-    # Check primary key
-    if api_key is not None and hmac.compare_digest(x_vds_scheduler_key, api_key.get_secret_value()):
-        return
-
-    # Check old key (dual-key rotation window)
-    if api_key_old is not None and hmac.compare_digest(x_vds_scheduler_key, api_key_old.get_secret_value()):
-        return
-
-    raise HTTPException(
-        status_code=status.HTTP_401_UNAUTHORIZED,
-        detail="Invalid API key",
-        headers={"WWW-Authenticate": "Bearer"},
-    )

package/tools/vds-scripts/scheduler_orchestrator/src/vds_scheduler_orchestrator/security/capabilities.py

@@ -1,111 +0,0 @@
-"""
-capabilities.py — Who-can-mutate-what policy enforcement.
-
-Implements TSK-2.4 (schedule ownership capability check, FR-8.1).
-
-Each orchestrator process is assigned a CAPABILITY via the
-VDS_SCHEDULER_CAPABILITY environment variable (default: "platform").
-Schedule mutation operations (pause, resume, delete, create-on-behalf-of)
-check ownership: only the owning orchestrator or the "platform" capability
-can mutate a schedule.
-
-Capability matrix:
-  platform                   — can mutate ANY schedule
-  audit_orchestrator         — can only mutate its own schedules
-  memory_orchestrator        — can only mutate its own schedules
-  progress_report_orchestrator — can only mutate its own schedules
-  multi_agent_orchestrator   — can only mutate its own schedules
-  (any new orchestrator)     — can only mutate its own schedules
-
-The matrix is intentionally permissive on the side of unknown capabilities
-(they can still own and mutate their own schedules) — the restriction is
-cross-orchestrator mutation, not registration.
-"""
-
-from __future__ import annotations
-
-# ── Constants ─────────────────────────────────────────────────────────────────
-
-PLATFORM_CAPABILITY = "platform"
-
-# Known orchestrator capability names (informational — the check is structural,
-# not a whitelist; any string can be a valid capability for a new orchestrator).
-KNOWN_CAPABILITIES: frozenset[str] = frozenset(
-    {
-        PLATFORM_CAPABILITY,
-        "audit_orchestrator",
-        "memory_orchestrator",
-        "progress_report_orchestrator",
-        "multi_agent_orchestrator",
-    }
-)
-
-
-# ── Exception ─────────────────────────────────────────────────────────────────
-
-
-class CapabilityError(PermissionError):
-    """Raised when a process capability cannot perform the requested operation.
-
-    http_status = 403 — API layer should map this to an HTTP 403 response.
-    """
-
-    http_status: int = 403
-
-    def __init__(
-        self,
-        caller_capability: str,
-        operation: str,
-        schedule_owner: str,
-    ) -> None:
-        self.caller_capability = caller_capability
-        self.operation = operation
-        self.schedule_owner = schedule_owner
-        super().__init__(
-            f"capability {caller_capability!r} cannot {operation} a schedule "
-            f"owned by {schedule_owner!r}; "
-            f"use the owning capability or '{PLATFORM_CAPABILITY}'"
-        )
-
-
-# ── Policy enforcement ────────────────────────────────────────────────────────
-
-
-def require_schedule_owner(
-    schedule_owner: str,
-    caller_capability: str,
-    operation: str,
-) -> None:
-    """Assert that caller_capability is allowed to perform operation on a schedule.
-
-    Args:
-        schedule_owner:    The owner_orchestrator value stored on the schedule row.
-        caller_capability: The VDS_SCHEDULER_CAPABILITY of the calling process.
-        operation:         Human-readable operation name for the error message
-                           (e.g., "pause", "delete", "resume").
-
-    Raises:
-        CapabilityError: If the caller is not the owner and is not "platform".
-    """
-    # platform can do anything
-    if caller_capability == PLATFORM_CAPABILITY:
-        return
-
-    # Same orchestrator can always mutate its own schedules
-    if caller_capability == schedule_owner:
-        return
-
-    raise CapabilityError(
-        caller_capability=caller_capability,
-        operation=operation,
-        schedule_owner=schedule_owner,
-    )
-
-
-def can_mutate_schedule(schedule_owner: str, caller_capability: str) -> bool:
-    """Return True if caller_capability may mutate schedules owned by schedule_owner.
-
-    Non-raising variant of require_schedule_owner — useful for conditional
-    UI rendering in CLI output (e.g., marking rows the caller cannot touch).
-    """
-    return caller_capability in (PLATFORM_CAPABILITY, schedule_owner)

package/tools/vds-scripts/scheduler_orchestrator/src/vds_scheduler_orchestrator/security/middleware.py

@@ -1,54 +0,0 @@
-"""Rate-limiting middleware for 401 brute-force protection (TSK-N.63)."""
-
-from __future__ import annotations
-
-import time
-from collections import defaultdict
-from collections.abc import Awaitable, Callable
-
-from starlette.middleware.base import BaseHTTPMiddleware
-from starlette.requests import Request
-from starlette.responses import JSONResponse, Response
-
-RATE_LIMIT_ATTEMPTS = 10
-RATE_LIMIT_WINDOW_SEC = 60
-
-# In-process IP tracking. Single-process scope is acceptable for current
-# deployment topology; multi-replica would need shared state (tracked for v2.0.19+).
-_failure_tracker: defaultdict[str, list[float]] = defaultdict(list)
-
-
-class AuthBruteForceMiddleware(BaseHTTPMiddleware):
-    """Rate-limit 401 responses per-IP to prevent brute-force key enumeration.
-
-    After 10 failed auth attempts from the same IP within a 60-second window,
-    all subsequent requests from that IP receive HTTP 429 (Too Many Requests)
-    until the window expires.
-    """
-
-    async def dispatch(self, request: Request, call_next: Callable[[Request], Awaitable[Response]]) -> Response:
-        client_ip = request.client.host if request.client else "unknown"
-
-        # Prune expired entries before checking
-        now = time.time()
-        window_start = now - RATE_LIMIT_WINDOW_SEC
-        _failure_tracker[client_ip] = [t for t in _failure_tracker[client_ip] if t > window_start]
-
-        if len(_failure_tracker[client_ip]) >= RATE_LIMIT_ATTEMPTS:
-            return JSONResponse(
-                status_code=429,
-                content={"detail": "Too Many Requests"},
-                headers={"Retry-After": str(RATE_LIMIT_WINDOW_SEC)},
-            )
-
-        response = await call_next(request)
-
-        if response.status_code == 401:
-            _failure_tracker[client_ip].append(now)
-
-        return response
-
-
-def _reset_tracker_for_testing() -> None:
-    """Reset the in-memory failure tracker (test helper)."""
-    _failure_tracker.clear()