Spaces:
Paused
Paused
File size: 3,336 Bytes
aceb1b2 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 | """
Admin API Key Resolution
Shared utility for resolving the admin API key from config, environment,
or auto-generated key file. Used by both routes.py and admin.py to ensure
consistent authentication across all admin endpoints.
"""
import os
import hmac
import logging
logger = logging.getLogger(__name__)
# Cache for auto-generated admin API key
_generated_admin_api_key = None
def get_admin_api_key(config):
"""Get the admin API key from config, environment variable, or auto-generate one.
Priority order:
1. Config file: admin_api_key setting
2. Environment variable: POTATO_ADMIN_API_KEY
3. Auto-generated: Creates a random key and saves it to {task_dir}/admin_api_key.txt
Args:
config: The application config dict.
Returns:
str or None: The admin API key, or None if generation fails.
"""
global _generated_admin_api_key
# Check config first
configured_key = config.get("admin_api_key")
if configured_key:
return configured_key
# Check environment variable
env_key = os.environ.get("POTATO_ADMIN_API_KEY")
if env_key:
return env_key
# Return cached generated key if we have one
if _generated_admin_api_key:
return _generated_admin_api_key
# Auto-generate a key and save it to task directory
task_dir = config.get("task_dir", ".")
if not task_dir:
task_dir = "."
key_file_path = os.path.join(task_dir, "admin_api_key.txt")
# Check if a key file already exists (from previous run)
if os.path.exists(key_file_path):
try:
with open(key_file_path, 'r', encoding='utf-8') as f:
existing_key = f.read().strip()
if existing_key:
_generated_admin_api_key = existing_key
logger.info(f"Loaded existing admin API key from {key_file_path}")
return _generated_admin_api_key
except Exception as e:
logger.warning(f"Could not read existing admin API key file: {e}")
# Generate a new key
import secrets
_generated_admin_api_key = secrets.token_urlsafe(32)
# Save to file
try:
with open(key_file_path, 'w', encoding='utf-8') as f:
f.write(_generated_admin_api_key)
logger.info(f"Generated admin API key and saved to {key_file_path}")
logger.info(f"Use this key to access the admin dashboard at /admin")
except Exception as e:
logger.warning(f"Could not save admin API key to file: {e}")
logger.info(f"Auto-generated admin API key (not persisted): {_generated_admin_api_key}")
return _generated_admin_api_key
def validate_admin_api_key(provided_key, config):
"""Validate an admin API key against the configured or auto-generated key.
Args:
provided_key: The API key provided in the request.
config: The application config dict.
Returns:
bool: True if the key is valid or debug mode is enabled.
"""
if config.get("debug", False):
return True
expected_key = get_admin_api_key(config)
if not expected_key:
logger.warning("Could not obtain admin API key")
return False
# Use constant-time comparison to prevent timing attacks
return hmac.compare_digest(str(provided_key or ""), expected_key)
|