71 lines
1.9 KiB
Python
71 lines
1.9 KiB
Python
from __future__ import annotations
|
|
|
|
import logging
|
|
import secrets
|
|
from typing import Iterable
|
|
|
|
from fastapi import Request
|
|
from fastapi.responses import JSONResponse
|
|
|
|
from app.config import ALLOWED_HOSTS, API_KEY, REQUIRE_API_KEY
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
API_KEY_EXEMPT_PATHS: frozenset[str] = frozenset(
|
|
{
|
|
"/api/health",
|
|
"/api/admin/login",
|
|
"/api/admin/status",
|
|
}
|
|
)
|
|
|
|
|
|
def api_key_configured() -> bool:
|
|
return bool(API_KEY)
|
|
|
|
|
|
def api_key_required() -> bool:
|
|
return REQUIRE_API_KEY or api_key_configured()
|
|
|
|
|
|
def validate_security_config() -> None:
|
|
if REQUIRE_API_KEY and not API_KEY:
|
|
raise RuntimeError("REQUIRE_API_KEY is enabled but API_KEY is not set. Generate one with: python scripts/setup_secrets.py")
|
|
if API_KEY and len(API_KEY) < 24:
|
|
raise RuntimeError("API_KEY must be at least 24 characters")
|
|
if api_key_configured() and not REQUIRE_API_KEY:
|
|
logger.warning("API_KEY is set but REQUIRE_API_KEY=false — API key auth is still enforced when API_KEY is present")
|
|
if not api_key_configured() and not REQUIRE_API_KEY:
|
|
logger.warning("API is running without API_KEY — set API_KEY and REQUIRE_API_KEY=true for production")
|
|
|
|
|
|
def is_api_key_exempt(path: str) -> bool:
|
|
return path in API_KEY_EXEMPT_PATHS
|
|
|
|
|
|
def extract_api_key(request: Request) -> str:
|
|
return request.headers.get("X-API-Key", "").strip()
|
|
|
|
|
|
def verify_request_api_key(request: Request) -> bool:
|
|
if not api_key_required():
|
|
return True
|
|
provided = extract_api_key(request)
|
|
if not provided:
|
|
return False
|
|
return secrets.compare_digest(provided, API_KEY)
|
|
|
|
|
|
def cors_allowed_origins() -> list[str]:
|
|
from app.config import ALLOWED_ORIGINS
|
|
|
|
if ALLOWED_ORIGINS:
|
|
return list(ALLOWED_ORIGINS)
|
|
if api_key_required():
|
|
return []
|
|
return ["*"]
|
|
|
|
|
|
def trusted_hosts() -> Iterable[str]:
|
|
return ALLOWED_HOSTS
|