93 lines
2.3 KiB
Python
93 lines
2.3 KiB
Python
"""
|
|
API 认证模块
|
|
"""
|
|
|
|
from typing import Optional
|
|
from fastapi import HTTPException, status, Security
|
|
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
|
|
|
|
from app.core.config import get_config
|
|
|
|
DEFAULT_API_KEY = ""
|
|
DEFAULT_APP_KEY = "grok2api"
|
|
|
|
# 定义 Bearer Scheme
|
|
security = HTTPBearer(
|
|
auto_error=False,
|
|
scheme_name="API Key",
|
|
description="Enter your API Key in the format: Bearer <key>",
|
|
)
|
|
|
|
|
|
def get_admin_api_key() -> str:
|
|
"""
|
|
获取后台 API Key。
|
|
|
|
为空时表示不启用后台接口认证。
|
|
"""
|
|
api_key = get_config("app.api_key", DEFAULT_API_KEY)
|
|
return api_key or ""
|
|
|
|
|
|
async def verify_api_key(
|
|
auth: Optional[HTTPAuthorizationCredentials] = Security(security),
|
|
) -> Optional[str]:
|
|
"""
|
|
验证 Bearer Token
|
|
|
|
如果 config.toml 中未配置 api_key，则不启用认证。
|
|
"""
|
|
api_key = get_admin_api_key()
|
|
if not api_key:
|
|
return None
|
|
|
|
if not auth:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Missing authentication token",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
if auth.credentials != api_key:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Invalid authentication token",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
return auth.credentials
|
|
|
|
|
|
async def verify_app_key(
|
|
auth: Optional[HTTPAuthorizationCredentials] = Security(security),
|
|
) -> Optional[str]:
|
|
"""
|
|
验证后台登录密钥（app_key）。
|
|
|
|
app_key 必须配置，否则拒绝登录。
|
|
"""
|
|
app_key = get_config("app.app_key", DEFAULT_APP_KEY)
|
|
|
|
if not app_key:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="App key is not configured",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
if not auth:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Missing authentication token",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
if auth.credentials != app_key:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Invalid authentication token",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
return auth.credentials
|