Fix: [UN-2941] Added InternalAPIAuthMiddleware to Django middleware stack

[muhammad-ali-e]

What

• Added InternalAPIAuthMiddleware to Django middleware stack in backend/backend/settings/base.py
• Positioned the middleware after TENANT_MIDDLEWARE to ensure proper organization context handling

Why

• To secure internal API endpoints that are called by workers
• To properly handle X-Organization-ID header from workers for authentication and authorization
• To prevent unauthorized access to internal backend APIs

How

• Added middleware.internal_api_auth.InternalAPIAuthMiddleware to the MIDDLEWARE list
• Placed it strategically after organization middleware but before security middleware
• The middleware validates internal API requests using the X-Organization-ID header

Can this PR break any existing features. If yes, please list possible items. If no, please explain why. (PS: Admins do not merge the PR without this section filled)

No, this should not break existing features because:

• The middleware is positioned to work with the existing tenant/organization middleware
• It only affects internal API endpoints that require the X-Organization-ID header
• External API calls and user-facing endpoints are not affected
• Workers already send the X-Organization-ID header, so this provides the missing authentication layer

Potential considerations:

• If any internal API calls are made without proper authentication headers, they may now be rejected (which is the intended security behavior)
• Worker-backend communication must include the INTERNAL_SERVICE_API_KEY environment variable

Database Migrations

• No database migrations required

Env Config

• Ensure INTERNAL_SERVICE_API_KEY is configured in both backend and worker environments
• This key should already be set for worker authentication

Relevant Docs

• Internal API Security documentation may need to be updated (if exists)
• Worker architecture documentation should reference this authentication mechanism

Related Issues or PRs

• Related to UN-2941 Jira ticket
• Part of the workers architecture implementation

Dependencies Versions

• No dependency changes required

Notes on Testing

• Verify that workers can successfully authenticate to internal backend APIs
• Test that external API calls continue to work without authentication headers
• Confirm that unauthorized internal API calls are properly rejected
• Test organization-scoped data access through internal APIs

Screenshots

N/A - Backend middleware configuration change

Checklist

I have read and understood the Contribution Guidelines.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/UN-2941-HOT-FIX_Add_internal_API_authentication_middleware

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud