westfarn
630b770c12
## Summary - Standalone Django 6 shortener: Bearer `/api/links/` (create/list/detail/disable) and public `GET /<code>` 302 - Host split, target-host allowlist, named rotatable tokens; `short_url` from `PUBLIC_SHORT_URL` - Landing page, DEBUG-only `/debug/` mint form, Django admin - Docker/compose (host **8005**), Gitea CI like monica_site (PR tests, beta on merge, prod button) - Caller contract in `API.md` Closes #1. Infra follow-up: [server-infra#22](ai_ml_operations/server-infra#22). ## Test plan - [ ] `cd site && uv run python manage.py test` - [ ] `docker compose up --build` → http://127.0.0.1:8005/ - [ ] `POST /api/links/` with `Bearer monica:dev-only-token` → 201 - [ ] `GET /<code>` → 302 to allowlisted https URL - [ ] No Bearer → 401; non-allowlisted host → 400 - [ ] `/debug/` only when `DEBUG=true` Reviewed-on: #2
69 lines
2.0 KiB
Python
69 lines
2.0 KiB
Python
"""Keep the short domain and Django admin off the public API hostname."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from django.conf import settings
|
|
from django.http import Http404, HttpRequest
|
|
|
|
|
|
def _normalize_host(host: str) -> str:
|
|
return host.split(":")[0].lower().rstrip(".")
|
|
|
|
|
|
def _host_in(host: str, configured: list[str]) -> bool:
|
|
needle = _normalize_host(host)
|
|
raw = host.lower()
|
|
for entry in configured:
|
|
if not entry:
|
|
continue
|
|
if raw == entry.lower() or needle == _normalize_host(entry):
|
|
return True
|
|
return False
|
|
|
|
|
|
def is_api_host(host: str) -> bool:
|
|
return _host_in(host, list(getattr(settings, "SHORT_API_HOSTS", []) or []))
|
|
|
|
|
|
def is_public_host(host: str) -> bool:
|
|
return _host_in(host, list(getattr(settings, "SHORT_PUBLIC_HOSTS", []) or []))
|
|
|
|
|
|
def is_admin_host(host: str) -> bool:
|
|
return _host_in(host, list(getattr(settings, "SHORT_ADMIN_HOSTS", []) or []))
|
|
|
|
|
|
class HostSplitMiddleware:
|
|
"""Short host = redirects only. API host = /api/ (Bearer). Admin = local only.
|
|
|
|
A public DNS name may be listed in SHORT_API_HOSTS. Auth, not the network,
|
|
keeps /api/ closed: missing/wrong Bearer is 401; empty token list is 503.
|
|
"""
|
|
|
|
def __init__(self, get_response):
|
|
self.get_response = get_response
|
|
|
|
def __call__(self, request: HttpRequest):
|
|
path = request.path
|
|
if path in {"/healthz", "/healthz/"}:
|
|
return self.get_response(request)
|
|
|
|
host = request.get_host()
|
|
|
|
if path.startswith("/debug"):
|
|
if not settings.DEBUG or is_public_host(host):
|
|
raise Http404()
|
|
return self.get_response(request)
|
|
|
|
if path.startswith("/admin"):
|
|
if not is_admin_host(host):
|
|
raise Http404()
|
|
return self.get_response(request)
|
|
|
|
if path.startswith("/api/"):
|
|
# Short redirect hostname never serves the API, even if mis-listed.
|
|
if is_public_host(host) or not is_api_host(host):
|
|
raise Http404()
|
|
|
|
return self.get_response(request)
|