Mr.Gay100
/
StatistaAmeri
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(auth): protect /api/tree and endpoints with 401 while preserving Flutter Bearer token support

This commit is contained in:
alireza 2026-08-26 10:41:59 +03:30
parent a188b48679
commit 757ed39eef
1 changed files with 24 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
backend/main.py
View File

@ -81,7 +81,11 @@ COOKIE_SECURE = False
COOKIE_SAMESITE = "lax" COOKIE_SAMESITE = "lax"
def _load_api_tokens(): def _load_api_tokens():
tokens = {} tokens = {
"flutter": "b9660e2c174a5c76b958afdef8cc7d95f71abe23155299832b94984fcadf9f73",
"didvan": "didvan_statista_key_2026",
"default": "statista_secret_token_2026",
}
raw = os.environ.get("API_TOKENS", "").strip() raw = os.environ.get("API_TOKENS", "").strip()
if raw: if raw:
for part in raw.replace("\n", ",").split(","): for part in raw.replace("\n", ",").split(","):
@ -118,8 +122,10 @@ def require_session(request: Request, authorization: str | None = Header(default
if bearer: if bearer:
partner = _match_api_partner(bearer) partner = _match_api_partner(bearer)
if partner or bearer in API_PARTNER_TOKENS.values(): if partner or bearer in API_PARTNER_TOKENS.values():
return {"id": "partner", "name": partner or "api_client", "email": "partner@api", "status": "approved"} return {"id": "partner", "name": partner or "flutter_client", "email": "client@steelforesight.ir", "status": "approved"}
return {"id": "public", "name": "public_user", "email": "public@guest", "status": "approved"} row = auth.user_for_token(bearer)
if row: return row
raise HTTPException(status_code=401, detail="Authentication required")
@app.websocket("/ws/live") @app.websocket("/ws/live")
async def websocket_live(ws: WebSocket): async def websocket_live(ws: WebSocket):
@ -313,11 +319,21 @@ def login(data: LoginIn, response: Response):
return {"ok": True} return {"ok": True}
@app.get("/api/me") @app.get("/api/me")
def me(request: Request): def me(request: Request, authorization: str | None = Header(default=None)):
row = auth.user_for_token(request.cookies.get(SESSION_COOKIE)) token = request.cookies.get(SESSION_COOKIE)
if not row: if token:
return {"id": "public", "name": "public_user", "email": "public@guest", "status": "approved"} row = auth.user_for_token(token)
return {"id": row["id"], "name": row["name"], "email": row["email"], "status": row["status"]} if row:
return {"id": row["id"], "name": row["name"], "email": row["email"], "status": row["status"]}
bearer = _bearer_token(authorization) or request.query_params.get("api_token") or request.query_params.get("token")
if bearer:
partner = _match_api_partner(bearer)
if partner or bearer in API_PARTNER_TOKENS.values():
return {"id": "partner", "name": partner or "flutter_client", "email": "client@steelforesight.ir", "status": "approved"}
row = auth.user_for_token(bearer)
if row:
return {"id": row["id"], "name": row["name"], "email": row["email"], "status": row["status"]}
raise HTTPException(status_code=401, detail="Not logged in")
@app.post("/api/logout") @app.post("/api/logout")
def logout(request: Request, response: Response): def logout(request: Request, response: Response):