auth: allowlist agent Bearer access to task checklist routes

[jaylfc]

Why

The task checklist handlers in #2415 authorize agents via the project_tasks_create scope, and their docstrings advertise agent access — but tinyagentos/auth_middleware.py holds an exact (method, path-regex) Bearer allowlist (_AGENT_TASK_ROUTES) with no checklist pattern. A registry JWT is therefore refused 401 Authentication required by the middleware BEFORE any scope check runs, making the agent-authorization branch in both handlers unreachable. This PR adds the two missing allowlist entries as their own diff, per the ruling on #2415.

Entries added (matching the anchoring and _SEG conventions of their neighbours):

("GET", re.compile(rf"^/api/projects/{_SEG}/tasks/{_SEG}/checklist-items$")),
("POST", re.compile(rf"^/api/projects/{_SEG}/tasks/{_SEG}/checklist-items$")),

Nothing wider: DELETE on the same path and the /checklist-items/{id} sibling remain session-only (there is no archive route; archiving is store-level and verified+reported-gated).

Proven red

The positive tests were run once against the UNPATCHED middleware (allowlist change stashed) before restoring it:

$ uv run --no-project --with pytest --with pytest-asyncio --with-editable . python -m pytest tests/test_auth_middleware.py -q -k Checklist
>       assert resp.status_code == 200
E       assert 401 == 200
E        +  where 401 = <starlette.responses.JSONResponse object at 0x709639b83250>.status_code
FAILED tests/test_auth_middleware.py::TestIsAgentTaskChecklistPath::test_list_checklist_items_get_allowed
FAILED tests/test_auth_middleware.py::TestIsAgentTaskChecklistPath::test_create_checklist_item_post_allowed
FAILED tests/test_auth_middleware.py::TestTaskChecklistAgentTokenDispatch::test_checklist_list_bearer_passes
FAILED tests/test_auth_middleware.py::TestTaskChecklistAgentTokenDispatch::test_checklist_create_bearer_passes
4 failed, 5 passed, 58 deselected in 0.55s

Tests

Both halves at the granularity of the evidence, in tests/test_auth_middleware.py:

• TestIsAgentTaskChecklistPath — predicate-level: GET/POST checklist-items allowed; DELETE same path refused; /checklist-items/{id} (GET and PATCH) refused; /checklists near-miss sibling refused.
• TestTaskChecklistAgentTokenDispatch — middleware dispatch: a Bearer token on GET/POST checklist-items reaches call_next with via == "registry_jwt_candidate" (i.e. it reaches the handler's scope layer instead of the 401 gate); DELETE and the {id} subpath get 401 with call_next never awaited.

Commands run

$ uv run --no-project --with pytest --with pytest-asyncio --with-editable . python -m pytest tests/test_auth_middleware.py -q
67 passed in 0.54s   (exit 0)

Red run above exited 1 (4 failed) against the unpatched file.

Unblocks #2415; patterns are inert until the checklist routes merge.

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[coderabbitai]

Warning

Review limit reached

@jaylfc, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 4 minutes

Limit details: You’ve used all 2 included reviews currently available under your plan.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3abccd69-ccb2-433d-ad38-7ec4f2401b93

📥 Commits

Reviewing files that changed from the base of the PR and between 6f1d785 and 5053f3e.

📒 Files selected for processing (4)

• changelog.d/2430-auth-checklist-allowlist.md
• docs/agent-coordination.md
• tests/test_auth_middleware.py
• tinyagentos/auth_middleware.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gitar-bot]

Gitar is working

_Gitar

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (4 files)

• tinyagentos/auth_middleware.py
• tests/test_auth_middleware.py
• docs/agent-coordination.md
• changelog.d/2430-auth-checklist-allowlist.md

Previous Review Summary (commit f30e078)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit f30e078)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (3 files)

• tinyagentos/auth_middleware.py
• tests/test_auth_middleware.py
• changelog.d/2430-auth-checklist-allowlist.md

---

_{Reviewed by step-3.7-flash · Input: 46.4K · Output: 5.2K · Cached: 256.3K}