add port security policy to the exposed port

[edouardb]

No description provided.

[Copilot]

Pull request overview

This PR adds support for applying access-control security policies to the sandbox’s user-facing exposed port (route on port 3031), exposing the feature via the Sandbox.create()/AsyncSandbox.create() APIs and providing examples.

Changes:

• Introduces ApiKey and BasicAuth policy helpers and maps them to SecurityPolicies on the 3031 route.
• Extends sandbox creation to accept exposed_port_security_policy and applies it when default routes are generated.
• Adds sync/async examples demonstrating no-auth, API-key, and Basic Auth access control.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
uv.lock	Updates the lockfile; also introduces a new optional extra and packages (socks, pysocks, socksio).
koyeb/sandbox/utils.py	Adds policy dataclasses + builder, threads policy into generated routes and deployment definition.
koyeb/sandbox/sandbox.py	Adds exposed_port_security_policy parameter to sync/async sandbox creation + updates docstrings/examples.
koyeb/sandbox/__init__.py	Exports ApiKey and BasicAuth from koyeb.sandbox.
examples/21_port_security_policy.py	New sync example validating behavior for public/API-key/basic-auth.
examples/21_port_security_policy_async.py	New async example validating behavior for public/API-key/basic-auth.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.