added authorization

app.py

@@ -12,8 +12,9 @@ import insightface
 from insightface.app import FaceAnalysis
 from huggingface_hub import hf_hub_download
 
-from fastapi import FastAPI, UploadFile, File, HTTPException, Response
+from fastapi import FastAPI, UploadFile, File, HTTPException, Response, Depends, Security
 from fastapi.responses import RedirectResponse
+from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
 from pydantic import BaseModel
 from motor.motor_asyncio import AsyncIOMotorClient, AsyncIOMotorGridFSBucket
 from bson import ObjectId
@@ -127,6 +128,17 @@ async def shutdown_db():
         client.close()
         logger.info("MongoDB connection closed")
 
+# -------------------------------------------------
+# Auth Setup
+# -------------------------------------------------
+security = HTTPBearer()
+API_SECRET_TOKEN = os.getenv("API_SECRET_TOKEN")
+
+def verify_token(credentials: HTTPAuthorizationCredentials = Security(security)):
+    if credentials.credentials != API_SECRET_TOKEN:
+        raise HTTPException(status_code=401, detail="Invalid or missing token")
+    return credentials.credentials
+
 # -------------------------------------------------
 # Lock for face swap
 # -------------------------------------------------
@@ -209,13 +221,13 @@ async def health():
     return {"status": "healthy"}
 
 @fastapi_app.post("/source")
-async def upload_source(image: UploadFile = File(...)):
+async def upload_source(image: UploadFile = File(...), token: str = Depends(verify_token)):
     contents = await image.read()
     file_id = await fs_bucket.upload_from_stream(image.filename, contents, metadata={"type": "source"})
     return {"source_id": str(file_id)}
 
 @fastapi_app.get("/targets")
-async def list_targets():
+async def list_targets(token: str = Depends(verify_token)):
     files = []
     async for file in database.fs.files.find({"metadata.type": "target", "metadata.predefined": True}):
         files.append({
@@ -225,7 +237,7 @@ async def list_targets():
     return {"targets": files}
 
 @fastapi_app.post("/target")
-async def upload_target(image: UploadFile = File(...)):
+async def upload_target(image: UploadFile = File(...), token: str = Depends(verify_token)):
     contents = await image.read()
     file_id = await fs_bucket.upload_from_stream(image.filename, contents, metadata={"type": "target"})
     return {"target_id": str(file_id)}
@@ -235,7 +247,7 @@ class FaceSwapRequest(BaseModel):
     target_id: str
 
 @fastapi_app.post("/faceswap")
-async def perform_faceswap(request: FaceSwapRequest):
+async def perform_faceswap(request: FaceSwapRequest, token: str = Depends(verify_token)):
     try:
         src_stream = await fs_bucket.open_download_stream(ObjectId(request.source_id))
         src_bytes = await src_stream.read()
@@ -266,7 +278,7 @@ async def perform_faceswap(request: FaceSwapRequest):
     return {"result_id": str(result_id)}
 
 @fastapi_app.get("/download/{result_id}")
-async def download_result(result_id: str):
+async def download_result(result_id: str, token: str = Depends(verify_token)):
     try:
         stream = await fs_bucket.open_download_stream(ObjectId(result_id))
         data = await stream.read()