westfarn
630b770c12
## Summary - Standalone Django 6 shortener: Bearer `/api/links/` (create/list/detail/disable) and public `GET /<code>` 302 - Host split, target-host allowlist, named rotatable tokens; `short_url` from `PUBLIC_SHORT_URL` - Landing page, DEBUG-only `/debug/` mint form, Django admin - Docker/compose (host **8005**), Gitea CI like monica_site (PR tests, beta on merge, prod button) - Caller contract in `API.md` Closes #1. Infra follow-up: [server-infra#22](ai_ml_operations/server-infra#22). ## Test plan - [ ] `cd site && uv run python manage.py test` - [ ] `docker compose up --build` → http://127.0.0.1:8005/ - [ ] `POST /api/links/` with `Bearer monica:dev-only-token` → 201 - [ ] `GET /<code>` → 302 to allowlisted https URL - [ ] No Bearer → 401; non-allowlisted host → 400 - [ ] `/debug/` only when `DEBUG=true` Reviewed-on: #2
65 lines
2.1 KiB
Python
65 lines
2.1 KiB
Python
"""Bearer token auth for /api/. The lock that keeps a public API host closed."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import hmac
|
|
from collections.abc import Callable
|
|
from functools import wraps
|
|
|
|
from django.conf import settings
|
|
from django.http import HttpRequest, JsonResponse
|
|
from django.views.decorators.csrf import csrf_exempt
|
|
|
|
|
|
def parse_bearer(request: HttpRequest) -> str | None:
|
|
header = request.META.get("HTTP_AUTHORIZATION") or ""
|
|
if not header.startswith("Bearer "):
|
|
return None
|
|
token = header[7:].strip()
|
|
return token or None
|
|
|
|
|
|
def authenticate_token(raw_token: str | None) -> str | None:
|
|
"""Return the configured token name, or None if no match.
|
|
|
|
Accepts either ``name:secret`` (as callers send) or the bare secret.
|
|
Always compares against every configured token (constant-time).
|
|
"""
|
|
configured = list(getattr(settings, "SHORTENER_API_TOKENS", []) or [])
|
|
if not configured or not raw_token:
|
|
return None
|
|
|
|
matched_name: str | None = None
|
|
for name, secret in configured:
|
|
full = f"{name}:{secret}"
|
|
if hmac.compare_digest(raw_token, full) or hmac.compare_digest(raw_token, secret):
|
|
matched_name = name
|
|
# Keep looping so compare_digest runs for every token.
|
|
return matched_name
|
|
|
|
|
|
def token_name_for_request(request: HttpRequest) -> str | None:
|
|
return authenticate_token(parse_bearer(request))
|
|
|
|
|
|
def require_bearer(view: Callable) -> Callable:
|
|
"""Decorator: 503 if no tokens configured, 401 if missing/wrong Bearer."""
|
|
|
|
@csrf_exempt
|
|
@wraps(view)
|
|
def wrapper(request, *args, **kwargs):
|
|
configured = list(getattr(settings, "SHORTENER_API_TOKENS", []) or [])
|
|
if not configured:
|
|
return JsonResponse({"detail": "Service unavailable"}, status=503)
|
|
|
|
name = token_name_for_request(request)
|
|
if not name:
|
|
response = JsonResponse({"detail": "Unauthorized"}, status=401)
|
|
response["WWW-Authenticate"] = "Bearer"
|
|
return response
|
|
|
|
request.token_name = name
|
|
return view(request, *args, **kwargs)
|
|
|
|
return wrapper
|