🔒 [Security] Fix missing authentication on Jules API endpoints

[JuanCS-Dev]

This PR addresses a security vulnerability where sensitive endpoints in the Jules API were accessible without authentication.

Changes:

• Modified apps/agent-gateway/app/jules/router.py to require AuthContext dependency for all sensitive operations.
• Created tests/api/test_jules_security.py to test that endpoints return 401 Unauthorized without credentials and 200 OK with valid credentials (mocked).

Verification:

• Verified that tests/api/test_jules_security.py passes.
• Verified that a reproduction script (initially returning 200) now fails with 401 as expected.

---

PR created automatically by Jules for task 2917969918339943185 started by @JuanCS-Dev

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[gemini-code-assist]

Summary of Changes

Hello @JuanCS-Dev, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a critical security vulnerability by implementing mandatory authentication for all sensitive endpoints within the Jules API. The changes ensure that operations such as code scanning, fixing, refactoring, and task management are protected, preventing unauthorized access and enhancing the overall security posture of the application. New dedicated tests have been added to verify the correct enforcement of these authentication measures.

Highlights

• Security Enhancement: Enforced authentication on sensitive Jules API endpoints by introducing the AuthContext dependency, ensuring only authorized requests can access these operations.
• New Security Tests: Introduced a new test file (tests/api/test_jules_security.py) to comprehensively validate the authentication requirements for Jules API endpoints, covering both unauthorized and authorized access scenarios.

Changelog

• apps/agent-gateway/app/jules/router.py
  • Added Depends, AuthContext, and get_auth_context imports to facilitate authentication.
  • Modified trigger_scan endpoint to require AuthContext dependency.
  • Modified run_scan_now endpoint to require AuthContext dependency.
  • Modified get_latest_scan endpoint to require AuthContext dependency.
  • Modified get_scan_history endpoint to require AuthContext dependency.
  • Modified request_fix endpoint to require AuthContext dependency.
  • Modified request_refactor endpoint to require AuthContext dependency.
  • Modified update_dependencies endpoint to require AuthContext dependency.
  • Modified list_tasks endpoint to require AuthContext dependency.
  • Modified get_task endpoint to require AuthContext dependency.
  • Modified get_jules_stats endpoint to require AuthContext dependency.
• tests/api/test_jules_security.py
  • Added a new test file to verify that protected Jules API endpoints return 401 Unauthorized without credentials.
  • Included tests to confirm that protected endpoints succeed with valid, mocked authentication headers (returning 200 OK).
  • Ensured that the /v1/jules/health endpoint remains publicly accessible without authentication.

Activity

• The pull request was automatically created by Jules for task 2917969918339943185.
• The author, JuanCS-Dev, verified that the newly created security tests (tests/api/test_jules_security.py) pass successfully.
• The author confirmed that a reproduction script, which previously allowed unauthorized access to sensitive endpoints, now correctly fails with a 401 Unauthorized response as expected.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request successfully addresses a critical security vulnerability by implementing authentication on sensitive Jules API endpoints, integrating AuthContext and get_auth_context dependencies into relevant FastAPI routes, and adding comprehensive tests in tests/api/test_jules_security.py. However, a Medium severity Insecure Direct Object Reference (IDOR) vulnerability was identified in the get_task endpoint. While authentication is now required, it does not perform authorization, allowing any authenticated user to access task data belonging to other users. It is recommended to implement ownership checks to fix this.

[gemini-code-assist]

The get_task endpoint at /tasks/{task_id} is vulnerable to an Insecure Direct Object Reference (IDOR). While the endpoint correctly requires authentication, it fails to authorize if the authenticated user has the right to access the requested task. The auth context, containing the user's identity, is not used to verify task ownership. As a result, any authenticated user can view the details of any task in the system by providing its task_id, potentially leaking sensitive information contained in the task details, such as code snippets, file paths, or scan results.

[gemini-code-assist]

Directly modifying sys.path within test files can lead to brittle test setups and potential issues with module resolution in more complex environments or when the project structure evolves. It's generally more robust to manage Python's import paths using environment variables like PYTHONPATH or through project configuration (e.g., pyproject.toml with src layout). This ensures that module discovery is consistent and less prone to breaking changes.