Mark account routes as internal and include in schema

[Sadashii]

Closes #

Mark 3 routes in fastapi accounts as internal

Technical

Testing

Screenshot

Stakeholders

@RayBB

[Copilot]

Pull request overview

Marks three FastAPI account debugging/auth test routes as “internal” and conditionally includes them in the OpenAPI schema based on a local-dev environment flag.

Changes:

• Adds a SHOW_INTERNAL_IN_SCHEMA flag derived from LOCAL_DEV.
• Tags /account/test.json, /account/protected.json, and /account/optional.json as internal.
• Hides those endpoints from the OpenAPI schema unless running in local dev.

[Copilot]

SHOW_INTERNAL_IN_SCHEMA = os.getenv("LOCAL_DEV") is not None treats LOCAL_DEV=false (or any non-empty value) as enabled, which diverges from the rest of the FastAPI app where LOCAL_DEV is parsed as a boolean string (e.g., openlibrary/asgi_app.py:164 checks == "true"). This can unintentionally expose internal endpoints in the OpenAPI schema in environments that set LOCAL_DEV to a falsey string. Consider normalizing this to the same boolean parsing logic used elsewhere (e.g., .get(...).lower() == "true").

Suggested change

	SHOW_INTERNAL_IN_SCHEMA = os.getenv("LOCAL_DEV") is not None
	SHOW_INTERNAL_IN_SCHEMA = os.environ.get("LOCAL_DEV", "false").lower() == "true"

[Copilot]

/account/test.json returns the raw session cookie value (and parsed components) back to the client. Since the session cookie is set HttpOnly, echoing it via an API endpoint defeats that protection and makes session exfiltration easier if any same-origin XSS occurs. If this endpoint is intended only for local debugging, consider disabling the route entirely outside local dev (not just hiding it from the schema), or at minimum remove/guard the fields that expose cookie contents in non-local environments.

[Copilot]

These three internal endpoints repeat the same tags=["internal"], include_in_schema=SHOW_INTERNAL_IN_SCHEMA kwargs. To reduce duplication and keep future changes consistent, consider factoring these into a shared constant (e.g., INTERNAL_ROUTE_KWARGS = {...}) or a small helper so the configuration only lives in one place.

[RayBB]

Please remove the infogami changes. I know they sneak in there at weird times.

running make git would probably fix it and then you can commit that.

Other than that it looks pretty good for me!

Thanks!

[Sadashii]

Fixed

[RayBB]

Great job!