chore: initial import

plugins/tandoor-ai-import/app/auth.py

@@ -0,0 +1,41 @@
+from __future__ import annotations
+
+import base64
+import hmac
+import os
+
+from fastapi import Request
+from fastapi.responses import JSONResponse, Response
+
+
+def _unauthorized() -> Response:
+    return JSONResponse(
+        status_code=401,
+        content={"detail": "Anmeldung erforderlich."},
+        headers={"WWW-Authenticate": 'Basic realm="Tandoor AI Import"'},
+    )
+
+
+async def basic_auth_middleware(request: Request, call_next):
+    expected_password = os.environ.get("APP_PASSWORD", "")
+    if not expected_password:
+        return await call_next(request)
+
+    expected_username = os.environ.get("APP_USERNAME", "admin")
+    header = request.headers.get("Authorization", "")
+    if not header.startswith("Basic "):
+        return _unauthorized()
+
+    try:
+        decoded = base64.b64decode(header[6:]).decode("utf-8")
+        username, password = decoded.split(":", 1)
+    except Exception:
+        return _unauthorized()
+
+    if not (
+        hmac.compare_digest(username, expected_username)
+        and hmac.compare_digest(password, expected_password)
+    ):
+        return _unauthorized()
+
+    return await call_next(request)