chore: initial import

core/security.py

@@ -0,0 +1,51 @@
+# -*- coding: utf-8 -*-
+"""
+Optionaler HTTP-Basic-Schutz für die gesamte Suite.
+
+Ist APP_PASSWORD gesetzt, gilt der Schutz für Dashboard und alle Plugins.
+Die Zugangsdaten sind identisch zu denen, die der AI-Webimport bisher schon
+genutzt hat – bestehende .env-Dateien funktionieren unverändert weiter.
+"""
+from __future__ import annotations
+
+import base64
+import hmac
+import os
+
+from fastapi import Request
+from fastapi.responses import JSONResponse, Response
+
+OPEN_PATHS = ("/api/health",)
+
+
+def _unauthorized() -> Response:
+    return JSONResponse(
+        status_code=401,
+        content={"detail": "Anmeldung erforderlich."},
+        headers={"WWW-Authenticate": 'Basic realm="boehmitools"'},
+    )
+
+
+async def basic_auth_middleware(request: Request, call_next):
+    expected_password = os.environ.get("APP_PASSWORD", "")
+    if not expected_password or request.url.path in OPEN_PATHS:
+        return await call_next(request)
+
+    expected_username = os.environ.get("APP_USERNAME", "admin")
+    header = request.headers.get("Authorization", "")
+    if not header.startswith("Basic "):
+        return _unauthorized()
+
+    try:
+        decoded = base64.b64decode(header[6:]).decode("utf-8")
+        username, password = decoded.split(":", 1)
+    except Exception:
+        return _unauthorized()
+
+    if not (
+        hmac.compare_digest(username, expected_username)
+        and hmac.compare_digest(password, expected_password)
+    ):
+        return _unauthorized()
+
+    return await call_next(request)