mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-10-27 23:28:03 +09:00
Juan Denis
c8c93a8e0c
Add session-family revocation and migration 097, require current credentials for password changes, constrain API keys, and require verified WebAuthn authentication. Update browser token handling and add boundary regressions. Existing JWTs require fresh login; restricted keys deny undeclared endpoints.
41 lines
1.4 KiB
Python
41 lines
1.4 KiB
Python
"""API Key authentication middleware."""
|
|
from flask import g, request, jsonify
|
|
|
|
|
|
def register_api_key_auth(app):
|
|
"""Register API key authentication as a before_request handler."""
|
|
|
|
@app.before_request
|
|
def authenticate_api_key():
|
|
"""Check for X-API-Key header and validate."""
|
|
# Keep credentials request-local even when an embedding application
|
|
# deliberately keeps its Flask application context across requests.
|
|
g.pop('api_key', None)
|
|
g.pop('api_key_user', None)
|
|
api_key_header = request.headers.get('X-API-Key')
|
|
|
|
if not api_key_header:
|
|
return # No API key provided, fall through to JWT auth
|
|
|
|
from app.services.api_key_service import ApiKeyService
|
|
api_key = ApiKeyService.validate_key(api_key_header)
|
|
|
|
if not api_key:
|
|
return jsonify({'error': 'Invalid or expired API key'}), 401
|
|
|
|
from app.middleware.api_scope_middleware import enforce_request_scope
|
|
denied = enforce_request_scope(api_key)
|
|
if denied is not None:
|
|
return denied
|
|
|
|
# Record usage against the trusted client IP (see app.utils.client_ip).
|
|
from app.utils.client_ip import get_client_ip
|
|
api_key.record_usage(get_client_ip())
|
|
|
|
from app import db
|
|
db.session.commit()
|
|
|
|
# Store in g for downstream use
|
|
g.api_key = api_key
|
|
g.api_key_user = api_key.user
|