auth

README.md

@@ -13,3 +13,8 @@ license: apache-2.0
 ---
 
 Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+
+## Required environment variables
+
+- `MONGO_URI`
+- `FIREBASE_API_KEY` (required for `/audio/by-id` token verification)

app.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 
-import base64
+import asyncio
 import io
 import os
 import time
@@ -11,11 +11,12 @@ from typing import Optional
 
 import gradio as gr
 import pymongo
+import requests
 import soundfile as sf
 from bson.binary import Binary
 from bson.objectid import ObjectId
 from dotenv import load_dotenv
-from fastapi import Body, FastAPI, Form, Request, Response
+from fastapi import Body, FastAPI, Form, HTTPException, Request, Response
 from pydantic import BaseModel
 
 from model import ENGLISH_REPO_ID, get_pretrained_model
@@ -26,6 +27,12 @@ MONGO_URI = os.getenv("MONGO_URI", "").strip()
 MONGO_DB_NAME = os.getenv("MONGO_DB_NAME", "image_to_speech").strip()
 MONGO_COLLECTION = os.getenv("MONGO_COLLECTION", "audio").strip()
 MONGO_CAPTIONS_COLLECTION = os.getenv("MONGO_CAPTIONS_COLLECTION", "captions").strip()
+FIREBASE_API_KEY = os.getenv("FIREBASE_API_KEY", "").strip()
+
+ERRORS = {
+    "TOKEN_MISSING": "firebase_id_token is missing",
+    "TOKEN_INVALID": "Invalid Firebase token",
+}
 
 
 def log(msg: str) -> None:
@@ -199,6 +206,7 @@ class AudioByIdRequest(BaseModel):
     audio_id: str
     sid: Optional[int] = 0
     speed: Optional[float] = 1.0
+    firebase_id_token: Optional[str] = None
 
 
 api = FastAPI(title="Text-to-Speech API")
@@ -217,17 +225,45 @@ def _find_audio_doc(identifier: str):
     return None
 
 
+async def verify_firebase_token(firebase_id_token: str) -> dict:
+    """Verify Firebase ID token using REST API."""
+    if not firebase_id_token:
+        raise HTTPException(status_code=401, detail=ERRORS["TOKEN_MISSING"])
+    if not FIREBASE_API_KEY:
+        raise HTTPException(status_code=500, detail="FIREBASE_API_KEY is missing in .env")
+
+    url = f"https://identitytoolkit.googleapis.com/v1/accounts:lookup?key={FIREBASE_API_KEY}"
+    payload = {"idToken": firebase_id_token}
+
+    try:
+        resp = await asyncio.to_thread(requests.post, url, json=payload, timeout=10)
+        if resp.status_code != 200:
+            detail = resp.json().get("error", {}).get("message", ERRORS["TOKEN_INVALID"])
+            raise HTTPException(status_code=401, detail=f"Firebase token verification failed: {detail}")
+
+        users = resp.json().get("users", [])
+        if not users:
+            raise HTTPException(status_code=401, detail="Firebase token verification failed: no user found")
+        return users[0]
+    except requests.RequestException as e:
+        raise HTTPException(status_code=503, detail=f"Firebase verification service unavailable: {str(e)}")
+
+
 @api.post("/audio/by-id")
-def get_audio_by_id(
+async def get_audio_by_id(
     request: Request,
     payload: Optional[AudioByIdRequest] = Body(default=None),
     audio_id: Optional[str] = Form(default=None),
     sid: Optional[int] = Form(default=0),
     speed: Optional[float] = Form(default=1.0),
+    firebase_id_token: Optional[str] = Form(default=None),
 ):
     resolved_audio_id = audio_id or (payload.audio_id if payload else None)
     resolved_sid = payload.sid if payload and payload.sid is not None else sid
     resolved_speed = payload.speed if payload and payload.speed is not None else speed
+    resolved_firebase_token = firebase_id_token or (payload.firebase_id_token if payload else None)
+
+    await verify_firebase_token(resolved_firebase_token)
 
     if not resolved_audio_id:
         return _api_response(False, "audio_id is required", None)

requirements.txt

@@ -6,4 +6,5 @@ soundfile
 python-dotenv
 pydantic
 sherpa-onnx
-huggingface_hub
+huggingface_hub
+requests