42 lines
1.1 KiB
Python
42 lines
1.1 KiB
Python
from __future__ import annotations
|
|
|
|
import base64
|
|
import hmac
|
|
import os
|
|
|
|
from fastapi import Request
|
|
from fastapi.responses import JSONResponse, Response
|
|
|
|
|
|
def _unauthorized() -> Response:
|
|
return JSONResponse(
|
|
status_code=401,
|
|
content={"detail": "Anmeldung erforderlich."},
|
|
headers={"WWW-Authenticate": 'Basic realm="Tandoor AI Import"'},
|
|
)
|
|
|
|
|
|
async def basic_auth_middleware(request: Request, call_next):
|
|
expected_password = os.environ.get("APP_PASSWORD", "")
|
|
if not expected_password:
|
|
return await call_next(request)
|
|
|
|
expected_username = os.environ.get("APP_USERNAME", "admin")
|
|
header = request.headers.get("Authorization", "")
|
|
if not header.startswith("Basic "):
|
|
return _unauthorized()
|
|
|
|
try:
|
|
decoded = base64.b64decode(header[6:]).decode("utf-8")
|
|
username, password = decoded.split(":", 1)
|
|
except Exception:
|
|
return _unauthorized()
|
|
|
|
if not (
|
|
hmac.compare_digest(username, expected_username)
|
|
and hmac.compare_digest(password, expected_password)
|
|
):
|
|
return _unauthorized()
|
|
|
|
return await call_next(request)
|