Add Bearer token authentication to all API endpoints

- Added HTTPBearer authentication with password: logicgo_videoswap@153
- All API endpoints now require Authorization header with Bearer token
- Test endpoint /api/test remains public for verification
- Password can be set via API_PASSWORD environment variable

api_server.py

@@ -1,5 +1,6 @@
-from fastapi import FastAPI, File, UploadFile, HTTPException, BackgroundTasks
+from fastapi import FastAPI, File, UploadFile, HTTPException, BackgroundTasks, Depends, Security
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 from pydantic import BaseModel
 from typing import Optional, List
 import os
@@ -22,6 +23,20 @@ from DeepFakeAI.processors.frame.modules import face_swapper as DF_FS
 
 app = FastAPI(title="Face Swap Video API", version="1.0.0")
 
+# Authentication
+API_PASSWORD = os.getenv("API_PASSWORD", "logicgo_videoswap@153")
+security = HTTPBearer()
+
+def verify_api_key(credentials: HTTPAuthorizationCredentials = Security(security)):
+    """Verify API key from Bearer token"""
+    if credentials.credentials != API_PASSWORD:
+        raise HTTPException(
+            status_code=401,
+            detail="Invalid authentication credentials",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    return credentials.credentials
+
 # CORS middleware
 app.add_middleware(
     CORSMiddleware,
@@ -232,7 +247,10 @@ async def process_face_swap(job_id: str, source_image_path: str, target_video_pa
 # API Endpoints
 
 @app.post("/api/source-image", response_model=SourceImageResponse)
-async def upload_source_image(file: UploadFile = File(...)):
+async def upload_source_image(
+    file: UploadFile = File(...),
+    api_key: str = Depends(verify_api_key)
+):
     """Upload and store source image in MongoDB"""
     if not file.content_type.startswith('image/'):
         raise HTTPException(status_code=400, detail="File must be an image")
@@ -265,7 +283,10 @@ async def upload_source_image(file: UploadFile = File(...)):
         raise HTTPException(status_code=500, detail=f"Error uploading source image: {str(e)}")
 
 @app.post("/api/target-video", response_model=TargetVideoResponse)
-async def upload_target_video(file: UploadFile = File(...)):
+async def upload_target_video(
+    file: UploadFile = File(...),
+    api_key: str = Depends(verify_api_key)
+):
     """Upload and store target video in MongoDB"""
     if not file.content_type.startswith('video/'):
         raise HTTPException(status_code=400, detail="File must be a video")
@@ -298,7 +319,11 @@ async def upload_target_video(file: UploadFile = File(...)):
         raise HTTPException(status_code=500, detail=f"Error uploading target video: {str(e)}")
 
 @app.post("/api/face-swap", response_model=JobStatus)
-async def start_face_swap(request: FaceSwapRequest, background_tasks: BackgroundTasks):
+async def start_face_swap(
+    request: FaceSwapRequest,
+    background_tasks: BackgroundTasks,
+    api_key: str = Depends(verify_api_key)
+):
     """Start face swap processing"""
     try:
         # Get source image and target video from MongoDB
@@ -341,7 +366,7 @@ async def start_face_swap(request: FaceSwapRequest, background_tasks: Background
         raise HTTPException(status_code=500, detail=f"Error starting face swap: {str(e)}")
 
 @app.get("/api/job/{job_id}", response_model=JobStatus)
-async def get_job_status(job_id: str):
+async def get_job_status(job_id: str, api_key: str = Depends(verify_api_key)):
     """Get job status"""
     job = await jobs_collection.find_one({"job_id": job_id})
     if not job:
@@ -361,7 +386,7 @@ async def get_job_status(job_id: str):
     )
 
 @app.get("/api/result-video/{result_video_id}")
-async def get_result_video(result_video_id: str):
+async def get_result_video(result_video_id: str, api_key: str = Depends(verify_api_key)):
     """Get result video file"""
     result = await result_videos_collection.find_one({"_id": ObjectId(result_video_id)})
     if not result:
@@ -377,7 +402,7 @@ async def get_result_video(result_video_id: str):
     )
 
 @app.get("/api/source-images", response_model=List[SourceImageResponse])
-async def list_source_images():
+async def list_source_images(api_key: str = Depends(verify_api_key)):
     """List all source images"""
     cursor = source_images_collection.find().sort("uploaded_at", -1)
     images = []
@@ -392,7 +417,7 @@ async def list_source_images():
     return images
 
 @app.get("/api/target-videos", response_model=List[TargetVideoResponse])
-async def list_target_videos():
+async def list_target_videos(api_key: str = Depends(verify_api_key)):
     """List all target videos"""
     cursor = target_videos_collection.find().sort("uploaded_at", -1)
     videos = []
@@ -407,7 +432,7 @@ async def list_target_videos():
     return videos
 
 @app.get("/api/result-videos", response_model=List[ResultVideoResponse])
-async def list_result_videos():
+async def list_result_videos(api_key: str = Depends(verify_api_key)):
     """List all result videos"""
     cursor = result_videos_collection.find().sort("created_at", -1)
     results = []
@@ -424,8 +449,8 @@ async def list_result_videos():
     return results
 
 @app.get("/api/health")
-async def api_health():
-    """Health check endpoint with GPU status"""
+async def api_health(api_key: str = Depends(verify_api_key)):
+    """Health check endpoint with GPU status (requires authentication)"""
     import onnxruntime
     available_providers = onnxruntime.get_available_providers()
     gpu_available = 'CUDAExecutionProvider' in available_providers
@@ -439,8 +464,30 @@ async def api_health():
 
 @app.get("/")
 async def root():
-    """Health check endpoint"""
-    return {"message": "Face Swap Video API is running", "version": "1.0.0"}
+    """Root endpoint - shows API is running"""
+    return {
+        "message": "Face Swap Video API is running", 
+        "version": "1.0.0",
+        "docs": "/docs",
+        "health": "/api/health"
+    }
+
+
+# Test endpoint to verify API is accessible (no auth required for testing)
+@app.get("/api/test")
+async def test_endpoint():
+    """Test endpoint to verify API is running (public endpoint)"""
+    return {
+        "status": "ok",
+        "message": "API is accessible",
+        "authentication": "Bearer token required for all endpoints except /api/test",
+        "endpoints": {
+            "upload_source": "POST /api/source-image",
+            "upload_target": "POST /api/target-video",
+            "face_swap": "POST /api/face-swap",
+            "health": "GET /api/health"
+        }
+    }
 
 if __name__ == "__main__":
     import uvicorn