server/app/auth.py

from __future__ import annotations

import secrets

from fastapi import Header, HTTPException, status

from app.config import settings


def verify_api_key(key: str) -> bool:
    """Constant-time check against every configured API key."""
    valid = False
    for stored_key in settings.api_keys_list:
        if secrets.compare_digest(stored_key.encode(), key.encode()):
            valid = True
    return valid


def verify_admin_key(key: str) -> bool:
    if not settings.admin_key:
        return False
    return secrets.compare_digest(settings.admin_key.encode(), key.encode())


def get_api_key(x_api_key: str = Header(..., alias="X-Api-Key")) -> str:
    if not verify_api_key(x_api_key):
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid API key")
    return x_api_key


def get_admin_key(x_api_key: str = Header(..., alias="X-Api-Key")) -> str:
    if not verify_admin_key(x_api_key):
        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid admin key")
    return x_api_key