modified app.py

app.py

@@ -12,9 +12,8 @@ import insightface
 from insightface.app import FaceAnalysis
 from huggingface_hub import hf_hub_download
 
-from fastapi import FastAPI, UploadFile, File, HTTPException, Response, Depends, Security
+from fastapi import FastAPI, UploadFile, File, HTTPException, Request, Response
 from fastapi.responses import RedirectResponse
-from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
 from pydantic import BaseModel
 from motor.motor_asyncio import AsyncIOMotorClient, AsyncIOMotorGridFSBucket
 from bson import ObjectId
@@ -129,15 +128,29 @@ async def shutdown_db():
         logger.info("MongoDB connection closed")
 
 # -------------------------------------------------
-# Auth Setup
+# 🔐 Global Auth Middleware
 # -------------------------------------------------
-security = HTTPBearer()
+PUBLIC_PATHS = ["/", "/health", "/gradio"]
+
 API_SECRET_TOKEN = os.getenv("API_SECRET_TOKEN")
+if not API_SECRET_TOKEN:
+    raise RuntimeError("❌ API_SECRET_TOKEN not set in environment!")
+
+@fastapi_app.middleware("http")
+async def auth_middleware(request: Request, call_next):
+    path = request.url.path
+    if any(path.startswith(p) for p in PUBLIC_PATHS):
+        return await call_next(request)
+
+    auth_header = request.headers.get("Authorization")
+    if not auth_header or not auth_header.startswith("Bearer "):
+        return Response(content="Missing Bearer token", status_code=401)
+
+    token = auth_header.split("Bearer ")[1]
+    if token != API_SECRET_TOKEN:
+        return Response(content="Invalid token", status_code=403)
 
-def verify_token(credentials: HTTPAuthorizationCredentials = Security(security)):
-    if credentials.credentials != API_SECRET_TOKEN:
-        raise HTTPException(status_code=401, detail="Invalid or missing token")
-    return credentials.credentials
+    return await call_next(request)
 
 # -------------------------------------------------
 # Lock for face swap
@@ -221,13 +234,13 @@ async def health():
     return {"status": "healthy"}
 
 @fastapi_app.post("/source")
-async def upload_source(image: UploadFile = File(...), token: str = Depends(verify_token)):
+async def upload_source(image: UploadFile = File(...)):
     contents = await image.read()
     file_id = await fs_bucket.upload_from_stream(image.filename, contents, metadata={"type": "source"})
     return {"source_id": str(file_id)}
 
 @fastapi_app.get("/targets")
-async def list_targets(token: str = Depends(verify_token)):
+async def list_targets():
     files = []
     async for file in database.fs.files.find({"metadata.type": "target", "metadata.predefined": True}):
         files.append({
@@ -237,7 +250,7 @@ async def list_targets(token: str = Depends(verify_token)):
     return {"targets": files}
 
 @fastapi_app.post("/target")
-async def upload_target(image: UploadFile = File(...), token: str = Depends(verify_token)):
+async def upload_target(image: UploadFile = File(...)):
     contents = await image.read()
     file_id = await fs_bucket.upload_from_stream(image.filename, contents, metadata={"type": "target"})
     return {"target_id": str(file_id)}
@@ -247,7 +260,7 @@ class FaceSwapRequest(BaseModel):
     target_id: str
 
 @fastapi_app.post("/faceswap")
-async def perform_faceswap(request: FaceSwapRequest, token: str = Depends(verify_token)):
+async def perform_faceswap(request: FaceSwapRequest):
     try:
         src_stream = await fs_bucket.open_download_stream(ObjectId(request.source_id))
         src_bytes = await src_stream.read()
@@ -278,7 +291,7 @@ async def perform_faceswap(request: FaceSwapRequest, token: str = Depends(verify
     return {"result_id": str(result_id)}
 
 @fastapi_app.get("/download/{result_id}")
-async def download_result(result_id: str, token: str = Depends(verify_token)):
+async def download_result(result_id: str):
     try:
         stream = await fs_bucket.open_download_stream(ObjectId(result_id))
         data = await stream.read()
@@ -292,9 +305,9 @@ async def download_result(result_id: str, token: str = Depends(verify_token)):
     )
 
 # -------------------------------------------------
-# Mount Gradio
+# Mount Gradio (last, without overwriting app)
 # -------------------------------------------------
-fastapi_app = mount_gradio_app(fastapi_app, demo, path="/gradio")
+mount_gradio_app(fastapi_app, demo, path="/gradio")
 
 if __name__ == "__main__":
     uvicorn.run(fastapi_app, host="0.0.0.0", port=7860)