[raghvendradhakar]

What

Turns off the /uap/* routes by default, for security. A new flag, UAP_ROUTES_ENABLED, controls them. It follows MCP_PUBLIC_ENDPOINT_ENABLED.

Deployments need no change. If the variable is unset, the routes are off.

Why

Nobody uses UAP today, and the routes have these problems:

• Parallel payments can pass the rider's spending limit.
• A missing provider fare falls back to the amount the client sent.
• The routes have no caller auth.

What this does not fix

The bugs stay in the code. Fix them before setting UAP_ROUTES_ENABLED=true. The flag comment in app/core/config/static.py lists them.

Security findings: BK-17 and BK-18 are mitigated, not fixed.

While the routes are off, /uap/webhook returns 404. The uap credential row and any active mandates at Juspay stay in place.

Changes

File	Change
app/core/config/static.py	Adds the flag and its comment
app/api/routers/breeze_buddy/__init__.py	Mounts the UAP router only when the flag is on
CLAUDE.md	Notes that the routes are off by default
tests/test_api_docs_disabled.py	Tests that no /uap/ route is served by default

Testing

• Flag unset: 140 paths on the Breeze Buddy router, no /uap routes.
• Flag set to true: 149 paths, all 9 /uap routes return.
• The new test fails with the flag on, as it should.
• tests/crm and the UAP, credential, and docs tests pass: 1664 passed, 15 skipped.
• Local runs used a stub for google.cloud.kms and test JWT values. No server or database ran.

CI runs only tests/crm, so it does not run the new test.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1a09d165-e6b4-408f-8b1c-da5df9da8c73

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}