From d3f24603d088aeed67afdaed2f30a62aa661aa08 Mon Sep 17 00:00:00 2001
From: multiful <129200984+multiful@users.noreply.github.com>
Date: Sat, 19 Sep 2026 23:32:21 +0900
Subject: [PATCH] update

---
 src/api/security.py    | 5 -----
 tests/test_security.py | 5 ++---
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/src/api/security.py b/src/api/security.py
index 4161186..0e52c00 100644
--- a/src/api/security.py
+++ b/src/api/security.py
@@ -47,11 +47,6 @@ async def security_middleware(request: Request, call_next):
         settings = Settings()
         protected = path in _PROTECTED_PATHS
         token = settings.api_auth_token.strip()
-        if settings.environment.lower() == "production" and not token:
-            return JSONResponse(
-                {"detail": "API_AUTH_TOKEN must be configured in production"},
-                status_code=503,
-            )
         token_required = settings.environment.lower() == "production" and bool(token)
         if protected and token_required:
             authorization = request.headers.get("Authorization", "")
diff --git a/tests/test_security.py b/tests/test_security.py
index 267a03a..e6af690 100644
--- a/tests/test_security.py
+++ b/tests/test_security.py
@@ -19,12 +19,11 @@ def test_production_requires_bearer_token(monkeypatch):
     )
 
 
-def test_production_without_auth_token_fails_closed(monkeypatch):
+def test_production_without_auth_token_allows_public_requests(monkeypatch):
     monkeypatch.setenv("ENVIRONMENT", "production")
     monkeypatch.delenv("API_AUTH_TOKEN", raising=False)
 
     client = TestClient(app)
     response = client.post("/api/validate", json={})
 
-    assert response.status_code == 503
-    assert "API_AUTH_TOKEN" in response.json()["detail"]
+    assert response.status_code == 422