Tightens gateway location authorization and adds scope audit trail.
Changes
KOKONUT_STRICT_LOCATION_SCOPE env var: when enabled, 2-part scopes (no location segment) are rejected for location-specific requests
Scope audit trail: _scope_allows() returns the matched scope string; verify_request() includes scope_checked in response; audit metadata captures which scope was evaluated
Catch-all route warning: logs when requests hit undefined routes
Backward Compatibility
Default behavior unchanged (KOKONUT_STRICT_LOCATION_SCOPE defaults to off). Enable for strict 3-part scope enforcement.
Tests
7 tests covering strict mode, scope logging, and backward compatibility.
Summary
Tightens gateway location authorization and adds scope audit trail.
Changes
KOKONUT_STRICT_LOCATION_SCOPEenv var: when enabled, 2-part scopes (no location segment) are rejected for location-specific requests_scope_allows()returns the matched scope string;verify_request()includesscope_checkedin response; audit metadata captures which scope was evaluatedBackward Compatibility
Default behavior unchanged (
KOKONUT_STRICT_LOCATION_SCOPEdefaults to off). Enable for strict 3-part scope enforcement.Tests
7 tests covering strict mode, scope logging, and backward compatibility.