Update api.py

api.py

@@ -1,5 +1,5 @@
 from __future__ import annotations
-from fastapi import FastAPI, UploadFile, File, Form, BackgroundTasks, HTTPException
+from fastapi import FastAPI, UploadFile, File,Query, Form, BackgroundTasks, HTTPException
 from fastapi import Body
 from fastapi.responses import JSONResponse, FileResponse
 from fastapi.middleware.cors import CORSMiddleware
@@ -44,6 +44,7 @@ IDENTITIES_ROOT = Path("/tmp/characters")
 IDENTITIES_ROOT.mkdir(parents=True, exist_ok=True)
 MEDIA_ROOT = Path("/data/media")
 file_manager = FileManager(MEDIA_ROOT)
+HF_TOKEN = os.getenv("HF_TOKEN")
 
 # Sistema de jobs asíncronos
 class JobStatus(str, Enum):
@@ -55,8 +56,22 @@ class JobStatus(str, Enum):
 jobs: Dict[str, dict] = {}
 
 
+def validate_token(token: str):
+    """
+    Validate the provided token against the HF_TOKEN environment variable.
+    Raises an HTTPException if validation fails.
+    """
+    if HF_TOKEN is None:
+        raise RuntimeError("HF_TOKEN environment variable is not set on the server.")
+
+    if token != HF_TOKEN:
+        raise HTTPException(status_code=401, detail="Invalid token")
+
 @app.post("/upload_video", tags=["Media Manager"])
-async def upload_video(video: UploadFile = File(...)):
+async def upload_video(
+    video: UploadFile = File(...),
+    token: str = Query(..., description="Token required for authorization")
+    ):
     """
     Saves an uploaded video by hashing it with SHA1 and placing it under:
     /data/media/<sha1>/clip/<original_filename>
@@ -68,6 +83,7 @@ async def upload_video(video: UploadFile = File(...)):
     - Create folder /data/media/<sha1>/clip if missing.
     - Save the video inside /data/media/<sha1>/clip/.
     """
+    validate_token(token)
 
     # Read content into memory (needed to compute hash twice)
     file_bytes = await video.read()
@@ -113,7 +129,10 @@ async def upload_video(video: UploadFile = File(...)):
 
 
 @app.get("/download_video/{sha1}", tags=["Media Manager"])
-def download_video(sha1: str):
+def download_video(
+    sha1: str,
+    token: str = Query(..., description="Token required for authorization")
+    ):
     """
     Download a stored video by its SHA-1 directory name.
 
@@ -146,6 +165,8 @@ def download_video(sha1: str):
         - 404 if no MP4 files are found.
         - 404 if the file cannot be retrieved using FileManager.
     """
+    validate_token(token)
+    
     sha1_folder = MEDIA_ROOT / sha1
     clip_folder = sha1_folder / "clip"