libb.token_required

token_required(*, table=None, static_token=None, region=None, dynamodb_client=None)[source]

Decorator: gate a Flask view on a registry token, failing closed.

Extracts the key from the request (see _extract_presented_key()) and authorizes it via libb.tokenauth.verify_token; an unauthorized request gets a 401. Suited to machine endpoints (MCP / API) behind the standard Flask tier.

On success the authorized identity is published at flask.g.client_id before the view runs, so a view or an after-request logger can record which client called without re-reading the credential. This mirrors scope['state']['client_id'] on the ASGI side.

Parameters:

  • table – DynamoDB registry table name (optional).

  • static_token – Constant-time break-glass token (optional).

  • region – AWS region for a default boto3 client (optional).

  • dynamodb_client – Injected boto3 DynamoDB client (optional).

Returns:

A view decorator.