82 lines
2.2 KiB
Python
82 lines
2.2 KiB
Python
"""
|
|
API 认证模块
|
|
"""
|
|
from typing import Optional
|
|
from fastapi import Depends, HTTPException, status, Security
|
|
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
|
|
|
|
from app.core.config import get_config
|
|
|
|
# 定义 Bearer Scheme
|
|
security = HTTPBearer(
|
|
auto_error=False,
|
|
scheme_name="API Key",
|
|
description="Enter your API Key in the format: Bearer <key>"
|
|
)
|
|
|
|
|
|
async def verify_api_key(
|
|
auth: Optional[HTTPAuthorizationCredentials] = Security(security)
|
|
) -> Optional[str]:
|
|
"""
|
|
验证 Bearer Token
|
|
|
|
如果 config.toml 中未配置 api_key，则跳过验证。
|
|
如果配置了 api_key，则必须提供正确的 Authorization: Bearer <key>。
|
|
"""
|
|
api_key = get_config("app.api_key", "")
|
|
|
|
# 如果未配置 API Key，直接放行
|
|
if not api_key:
|
|
return None
|
|
|
|
if not auth:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Missing authentication token",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
if auth.credentials != api_key:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Invalid authentication token",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
return auth.credentials
|
|
|
|
|
|
async def verify_app_key(
|
|
auth: Optional[HTTPAuthorizationCredentials] = Security(security)
|
|
) -> Optional[str]:
|
|
"""
|
|
验证后台登录密钥（app_key）。
|
|
|
|
如果未配置 app_key，则跳过验证。
|
|
"""
|
|
app_key = get_config("app.app_key", "")
|
|
|
|
if not app_key:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="App key is not configured",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
if not auth:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Missing authentication token",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
if auth.credentials != app_key:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Invalid authentication token",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
return auth.credentials
|