fix(rest-api): warn about disabled auth at server startup, not just the CLI

The exposed-without-token warning lived only in main(), so a non-CLI launch
(uvicorn/gunicorn --factory) that binds a public interface without a token got
a silently world-open API with no warning. Move it into create_app()'s lifespan
startup so it fires for every launch path. create_app() can't see the bind host
under a factory launch, so the check is host-agnostic (warn whenever no token is
configured) — a single calm log line, harmless on loopback, and silent in the
unit suite (tests don't enter the TestClient context manager, so lifespan never
runs there).

Author: KylinMountain

openkb/api.py

@@ -4,8 +4,8 @@
 
 import argparse
 import asyncio
+import logging
 import os
-import sys
 from contextlib import asynccontextmanager
 from typing import Any
 
@@ -96,6 +96,8 @@
 from openkb.log import append_log
 from openkb.watch_service import WatchRegistry
 
+logger = logging.getLogger(__name__)
+
 
 def create_app() -> FastAPI:
     # One registry per app instance so each TestClient is isolated.
@@ -125,6 +127,17 @@ def _kb_mutation_lock(kb: str) -> asyncio.Lock:
 
     @asynccontextmanager
     async def lifespan(app: FastAPI):
+        # Auth is opt-in (see require_bearer_token). Warn once at server startup
+        # when no token is configured, so an exposed deployment is never
+        # silently world-open. Fires for every launch path (uvicorn/gunicorn/
+        # the openkb-api CLI); harmless on loopback. (create_app() can't see the
+        # bind host under a factory launch, so this is host-agnostic.)
+        if not os.environ.get("OPENKB_API_TOKEN"):
+            logger.warning(
+                "OPENKB_API_TOKEN is not set — the REST API is unauthenticated. "
+                "This is fine for local use; set OPENKB_API_TOKEN to require a "
+                "bearer token before exposing the server on a reachable interface."
+            )
         try:
             yield
         finally:
@@ -563,20 +576,6 @@ def main() -> None:
     parser.add_argument("--reload", action="store_true")
     args = parser.parse_args()
 
-    # Auth is opt-in (see require_bearer_token). That's fine on loopback, but
-    # warn loudly if the server is bound to a reachable interface without a
-    # token — otherwise the API (and any KB it can touch) is world-open.
-    if not os.environ.get("OPENKB_API_TOKEN") and args.host not in {
-        "127.0.0.1",
-        "localhost",
-        "::1",
-    }:
-        print(
-            f"WARNING: OPENKB_API_TOKEN is not set — the REST API is UNAUTHENTICATED "
-            f"and reachable on {args.host}. Set OPENKB_API_TOKEN to require a bearer token.",
-            file=sys.stderr,
-        )
-
     import uvicorn
 
     # Use the factory so uvicorn can reload a fresh app instance and so the