ok

api/server.py

@@ -33,10 +33,11 @@ from typing import Annotated, Any, Dict, List, Optional
 from urllib.parse import urlparse
 
 import httpx
-from fastapi import FastAPI, File, Form, HTTPException, UploadFile, status
+from fastapi import Depends, FastAPI, File, Form, HTTPException, Security, UploadFile, status
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.middleware.gzip import GZipMiddleware
 from fastapi.responses import PlainTextResponse
+from fastapi.security import APIKeyHeader
 from pydantic import BaseModel, field_validator
 
 from core import ConversionError, ConversionResult, DocumentConverter, SUPPORTED_EXTENSIONS
@@ -56,9 +57,19 @@ _thread_pool = concurrent.futures.ThreadPoolExecutor(max_workers=MAX_WORKERS)
 
 _converter = DocumentConverter()
 
+_X_API_KEY = os.environ.get("X_API_KEY", "")
+
 logger.info("Thread pool initialised with %d workers", MAX_WORKERS)
 
 
+def _validate_api_key(x_api_key: str = Security(APIKeyHeader(name="x-api-key", auto_error=False))) -> str:
+    if not _X_API_KEY:
+        return x_api_key
+    if x_api_key == _X_API_KEY:
+        return x_api_key
+    raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid x-api-key")
+
+
 # ---------------------------------------------------------------------------
 # Self-ping
 # ---------------------------------------------------------------------------
@@ -315,7 +326,7 @@ def _batch_result_from_ok(result: ConversionResult) -> BatchFileResult:
 # ---------------------------------------------------------------------------
 
 @app.get("/health", tags=["System"], summary="Liveness check")
-async def health():
+async def health(_: str = Depends(_validate_api_token)):
     """Return server status and uptime in seconds."""
     return {
         "success":        True,
@@ -327,7 +338,7 @@ async def health():
 
 
 @app.get("/info", tags=["System"], summary="Server and environment information")
-async def info():
+async def info(_: str = Depends(_validate_api_key)):
     """Return application version, platform details, and operational limits."""
     import platform
 
@@ -345,7 +356,7 @@ async def info():
 
 
 @app.get("/formats", tags=["System"], summary="Supported file formats by category")
-async def list_formats():
+async def list_formats(_: str = Depends(_validate_api_key)):
     """Return all supported file extensions, grouped by document category."""
     by_category = {
         "documents": [e for e in SUPPORTED_EXTENSIONS if e in {".pdf", ".docx", ".doc", ".epub"}],
@@ -366,7 +377,7 @@ async def list_formats():
 
 
 @app.get("/spacy-labels", tags=["System"], summary="Available spaCy NER labels for field extraction")
-async def list_spacy_labels():
+async def list_spacy_labels(_: str = Depends(_validate_api_key)):
     """Return spaCy Named Entity Recognition labels available for structured extraction mappings."""
     from extraction.spacy_extractor import VALID_SPACY_LABELS
 
@@ -410,6 +421,7 @@ async def convert_file(
             "Example: {\"company\": {\"source_type\": \"entity\", \"label\": \"ORG\"}}"
         ),
     ),
+    _: str = Depends(_validate_api_key),
 ):
     """Convert a single uploaded file to Markdown.
 
@@ -481,7 +493,7 @@ async def convert_file(
     tags=["Convert"],
     summary="Convert a public URL to Markdown",
 )
-async def convert_url(body: UrlRequest):
+async def convert_url(body: UrlRequest, _: str = Depends(_validate_api_key)):
     """Convert a public HTTP/HTTPS URL to Markdown.
 
     When ``return_json=true``, the URL content is fetched as raw bytes first
@@ -562,6 +574,7 @@ async def convert_url(body: UrlRequest):
 )
 async def batch_files(
     files: Annotated[List[UploadFile], File(description="Files to convert — maximum 10")],
+    _: str = Depends(_validate_api_key),
 ):
     """Convert up to 10 uploaded files in a single request.
 
@@ -626,7 +639,7 @@ async def batch_files(
     tags=["Batch"],
     summary="Convert multiple URLs (up to 20)",
 )
-async def batch_urls(body: BatchUrlRequest):
+async def batch_urls(body: BatchUrlRequest, _: str = Depends(_validate_api_key)):
     """Convert up to 20 public URLs in a single request.
 
     URLs are processed concurrently. Per-item results include success/error