@@ -384,7 +384,7 @@ The parameter injection system works in two phases:
384384
385385<Row >
386386 <Col >
387- Apply middleware to entire SubRouter groups for common functionality like authentication .
387+ Configure authentication handlers on SubRouters and apply authentication to routes using ` auth_required=True ` .
388388 </Col >
389389 <Col sticky >
390390 <CodeGroup title = " SubRouter Middleware" >
@@ -399,23 +399,26 @@ The parameter injection system works in two phases:
399399 def authenticate (self , request ):
400400 auth_header = request.headers.get(" authorization" , " " )
401401 if not auth_header.startswith(" Bearer " ):
402- return False
402+ return None
403403
404404 token = auth_header[7 :] # Remove "Bearer "
405405 return self .validate_admin_token(token)
406406
407407 def validate_admin_token (self , token ):
408408 # Your token validation logic
409- return token == " admin-secret-token"
409+ if token == " admin-secret-token" :
410+ return {" user" : " admin" } # Return identity object
411+ return None
410412
411- # Apply authentication to all admin routes
412- admin.add_auth_handler (AdminAuth())
413+ # Configure the authentication handler for this SubRouter
414+ admin.configure_authentication (AdminAuth())
413415
414- @admin.get (" /users" )
416+ # Routes must explicitly require authentication with auth_required=True
417+ @admin.get (" /users" , auth_required = True )
415418 def admin_users ():
416419 return {" admin_users" : [" user1" , " user2" ]}
417420
418- @admin.delete (" /users/:id" )
421+ @admin.delete (" /users/:id" , auth_required = True )
419422 def delete_user (path_params ):
420423 return {" deleted" : path_params[" id" ]}
421424 ```
0 commit comments