allow local-only reindex without token

bot_app.py

@@ -15,8 +15,6 @@ REINDEX_API_TOKEN = os.getenv("REINDEX_API_TOKEN")
 
 if not DISCORD_TOKEN:
     raise RuntimeError("DISCORD_TOKEN nao definido.")
-if not REINDEX_API_TOKEN:
-    raise RuntimeError("REINDEX_API_TOKEN nao definido.")
 
 index_rt = LocalIndexRuntime()
 
@@ -68,7 +66,9 @@ async def rag_cmd(ctx, *, question: str):
 async def reindex_cmd(ctx):
     await ctx.reply("Iniciando reindex... (pode demorar)")
     try:
-        headers = {"Authorization": f"Bearer {REINDEX_API_TOKEN}"}
+        headers = {}
+        if REINDEX_API_TOKEN:
+            headers["Authorization"] = f"Bearer {REINDEX_API_TOKEN}"
         r = await asyncio.to_thread(
             requests.post,
             "http://127.0.0.1:7860/reindex",

main.py

@@ -5,7 +5,7 @@ import time
 from pathlib import Path
 
 import uvicorn
-from fastapi import FastAPI, Header, HTTPException
+from fastapi import FastAPI, Header, HTTPException, Request
 from fastapi.responses import PlainTextResponse
 
 from bot_app import run_bot
@@ -83,17 +83,22 @@ def logs():
 
 
 @app.post("/reindex", response_class=PlainTextResponse)
-def reindex(authorization: str | None = Header(default=None)):
-    if not REINDEX_API_TOKEN:
-        raise HTTPException(status_code=500, detail="REINDEX_API_TOKEN not configured")
-
-    if not authorization:
-        raise HTTPException(status_code=401, detail="Missing Authorization header")
-
-    expected = f"Bearer {REINDEX_API_TOKEN}"
-    if authorization != expected:
-        raise HTTPException(status_code=403, detail="Invalid token")
-
+def reindex(request: Request, authorization: str | None = Header(default=None)):
+    if REINDEX_API_TOKEN:
+        if not authorization:
+            raise HTTPException(status_code=401, detail="Missing Authorization header")
+
+        expected = f"Bearer {REINDEX_API_TOKEN}"
+        if authorization != expected:
+            raise HTTPException(status_code=403, detail="Invalid token")
+        return run_ingest()
+
+    client_host = request.client.host if request.client else ""
+    if client_host not in {"127.0.0.1", "::1", "localhost"}:
+        raise HTTPException(
+            status_code=403,
+            detail="External /reindex disabled when REINDEX_API_TOKEN is not set",
+        )
     return run_ingest()