5e2094f2ad
FastAPI service in infra/media-worker implementing every MediaInferenceProvider operation behind HTTP API v1, plus capabilities. Bearer auth, MEDIA_ROOT realpath enforcement, strict request schemas, cancellation on disconnect, GPU/CPU gates with 503 overflow, input size/duration limits, lazy SHA256-pinned model downloads, fail-closed redaction with atomic output, offline pytest suite with fake backends, CPU/CUDA/ROCm Dockerfile and a license review of every model. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0138YqDj3ttfayRwuMKKrqVj
23 lines
629 B
Python
23 lines
629 B
Python
"""Bearer-token check for every route except /healthz."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import hmac
|
|
|
|
from fastapi import Request
|
|
|
|
from .errors import MediaError
|
|
|
|
|
|
def require_token(request: Request) -> None:
|
|
expected: str = request.app.state.settings.token
|
|
header = request.headers.get("authorization", "")
|
|
scheme, _, presented = header.partition(" ")
|
|
if (
|
|
scheme.lower() != "bearer"
|
|
or not presented
|
|
or not expected
|
|
or not hmac.compare_digest(presented.strip().encode(), expected.encode())
|
|
):
|
|
raise MediaError("unauthorized", "missing or invalid bearer token")
|