Auth

.env.example

@@ -0,0 +1,3 @@
+MONGO_URI=
+MONGO_DB_NAME=image_to_speech
+FIREBASE_API_KEY=

README.md

@@ -8,3 +8,15 @@ pinned: false
 ---
 
 Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+
+## API
+
+`POST /generate-caption` accepts multipart form-data:
+
+- `firebase_id_token` (required)
+- `file` or `files` image field(s), up to 5
+
+## Required environment variables
+
+- `MONGO_URI`
+- `FIREBASE_API_KEY`

app.py

@@ -1,9 +1,11 @@
 import io
+import asyncio
 import logging
 import os
 import re
 import threading
 from datetime import datetime, timezone
+from typing import Optional
 
 # Avoid invalid OMP setting from runtime environment (e.g. empty/non-numeric).
 _omp_threads = os.getenv("OMP_NUM_THREADS", "").strip()
@@ -11,14 +13,16 @@ if not _omp_threads.isdigit() or int(_omp_threads) < 1:
     os.environ["OMP_NUM_THREADS"] = "8"
 
 import torch
+import requests
 from dotenv import load_dotenv
-from fastapi import FastAPI, Request, UploadFile
+from fastapi import FastAPI, Form, HTTPException, Request, UploadFile
 from fastapi.exceptions import RequestValidationError
 from fastapi.responses import JSONResponse
 from PIL import Image, UnidentifiedImageError
 from pymongo import MongoClient
 from pymongo.errors import PyMongoError, ServerSelectionTimeoutError
 from starlette.datastructures import UploadFile as StarletteUploadFile
+from starlette.exceptions import HTTPException as StarletteHTTPException
 from transformers import (
     AutoModelForImageTextToText,
     AutoModelForSeq2SeqLM,
@@ -37,6 +41,7 @@ MAX_NEW_TOKENS = 120
 MAX_IMAGES = 5
 MONGO_URI = (os.getenv("MONGO_URI") or os.getenv("MONGODB_URI") or "").strip().strip('"').strip("'")
 MONGO_DB_NAME = os.getenv("MONGO_DB_NAME", "image_to_speech")
+FIREBASE_API_KEY = os.getenv("FIREBASE_API_KEY", "").strip().strip('"').strip("'")
 
 CAPTION_PROMPT = (
     "Act as a professional news reporter delivering a live on-scene report in real time. "
@@ -55,6 +60,11 @@ PROCESSOR_MAX_LENGTH = 8192
 
 logger = logging.getLogger(__name__)
 
+ERRORS = {
+    "TOKEN_MISSING": "firebase_id_token is missing",
+    "TOKEN_INVALID": "Invalid Firebase token",
+}
+
 
 def ok(message: str, data):
     return JSONResponse(
@@ -111,7 +121,7 @@ else:
 async def root():
     return {
         "success": True,
-        "message": "Use POST /generate-caption with form-data key 'file' or 'files' (up to 5 images).",
+        "message": "Use POST /generate-caption with form-data keys 'firebase_id_token' and 'file' or 'files' (up to 5 images).",
         "data": None,
     }
 
@@ -164,6 +174,16 @@ async def validation_error_handler(_, exc: RequestValidationError):
     return fail("Invalid request payload.", 422)
 
 
+@app.exception_handler(HTTPException)
+async def fastapi_http_exception_handler(_, exc: HTTPException):
+    return fail(str(exc.detail), exc.status_code)
+
+
+@app.exception_handler(StarletteHTTPException)
+async def starlette_http_exception_handler(_, exc: StarletteHTTPException):
+    return fail(str(exc.detail), exc.status_code)
+
+
 @app.exception_handler(Exception)
 async def unhandled_error_handler(_, exc: Exception):
     logger.exception("Unhandled server error: %s", exc)
@@ -175,6 +195,37 @@ def _ensure_db_ready():
         raise AppError(db_init_error, 503)
 
 
+def _ensure_firebase_ready():
+    if not FIREBASE_API_KEY:
+        raise AppError("FIREBASE_API_KEY is not set.", 503)
+
+
+async def verify_firebase_token(firebase_id_token: str) -> dict:
+    """Verify Firebase ID token using REST API."""
+    if not firebase_id_token:
+        raise HTTPException(status_code=401, detail=ERRORS["TOKEN_MISSING"])
+
+    _ensure_firebase_ready()
+    url = f"https://identitytoolkit.googleapis.com/v1/accounts:lookup?key={FIREBASE_API_KEY}"
+    payload = {"idToken": firebase_id_token}
+
+    try:
+        resp = await asyncio.to_thread(requests.post, url, json=payload, timeout=10)
+        if resp.status_code != 200:
+            detail = resp.json().get("error", {}).get("message", ERRORS["TOKEN_INVALID"])
+            raise HTTPException(status_code=401, detail=f"Firebase token verification failed: {detail}")
+
+        users = resp.json().get("users", [])
+        if not users:
+            raise HTTPException(status_code=401, detail="Firebase token verification failed: no user found")
+        return users[0]
+    except requests.RequestException as exc:
+        raise HTTPException(
+            status_code=503,
+            detail=f"Firebase verification service unavailable: {str(exc)}",
+        ) from exc
+
+
 def _finalize_caption(raw_text: str, max_sentences: int = CAPTION_MAX_SENTENCES) -> str:
     text = " ".join(raw_text.split()).strip()
     if not text:
@@ -360,11 +411,12 @@ def insert_record(collection, payload: dict) -> str:
         raise AppError("MongoDB insert failed.", 503) from exc
 
 
-async def _parse_images(request: Request) -> list[tuple[str, Image.Image]]:
-    try:
-        form = await request.form()
-    except Exception as exc:
-        raise AppError("Invalid request payload.", 422) from exc
+async def _parse_images(request: Request, form=None) -> list[tuple[str, Image.Image]]:
+    if form is None:
+        try:
+            form = await request.form()
+        except Exception as exc:
+            raise AppError("Invalid request payload.", 422) from exc
 
     uploads: list[UploadFile | StarletteUploadFile] = []
     for key in ("files", "files[]", "file"):
@@ -410,9 +462,14 @@ async def _parse_images(request: Request) -> list[tuple[str, Image.Image]]:
 
 
 @app.post("/generate-caption")
-async def generate_caption(request: Request):
+async def generate_caption(request: Request, firebase_id_token: Optional[str] = Form(None)):
     _ensure_db_ready()
-    images = await _parse_images(request)
+
+    form = await request.form()
+    token = firebase_id_token or form.get("firebase_id_token")
+    await verify_firebase_token(token)
+
+    images = await _parse_images(request, form=form)
 
     image_captions = []
     for filename, image in images: