v0.6.2 — inbound bearer authentication

Security release. CEmbedding previously had no inbound authentication of any kind: both HTTP surfaces served every request that reached them. Deployments exposed through a tunnel or reverse proxy should upgrade and configure a token.

Inbound bearer authentication

Set CEMBEDDING_AUTH_TOKEN and every request must carry Authorization: Bearer <token>. Missing headers, wrong schemes and wrong tokens are all rejected with 401, compared with hmac.compare_digest. Both surfaces are covered:

• the REST endpoints (/embed, /index, /search, /remove, /purge)
• the Streamable HTTP MCP transport, which binds 0.0.0.0:8403 by default

The REST surface binds loopback and is covered anyway. A loopback bind is not evidence that requests are local — a tunnel or reverse proxy forwards to loopback, and treating the bind address as a security boundary is exactly how a sibling server in this project ran publicly reachable and unauthenticated for 13 days. The warning logged when no token is configured says so explicitly.

Compatibility

Additive. With no token configured the server behaves exactly as 0.6.1 and logs a warning. Set CEMBEDDING_REQUIRE_AUTH=true to turn that warning into a startup error instead. Requiring a token stays opt-in in this release; a later release will make it the default.

Notes for operators

Installing 0.6.2 does not close anything on its own — the token has to be configured on the deployment. Clients must be updated to send the header before the server starts requiring it, or embedding calls will fail; note that consumers which fall back to local search on HTTP errors will degrade silently rather than fail loudly.

Verification

40 new regression tests (54 total) drive the real middleware at the ASGI and aiohttp layers. Mutation-proved: reintroducing a header-gated credential check on either surface, or rewording the warning to claim loopback safety, fails the suite.

Full changelog: v0.6.1...v0.6.2