JiuContinent
e3a4a6d426
feat: 添加审批系统和遗留查询功能支持 - 添加审批系统，包括审批请求模型、服务和路由，支持创建、批准和拒绝操作 - 实现审批API密钥验证机制，区分普通API和审批API访问权限 - 添加Alembic数据库迁移支持，更新初始schema版本并添加降级保护 - 配置遗留MySQL查询白名单机制，支持命名查询和参数化查询 - 更新业务服务以集成审批流程，高风险操作需要审批票证 - 调整安全认证使用常量定义的HTTP头，增强安全性比较 - 优化.gitignore配置，添加日志目录排除和文档文件包含规则 - 更新Dockerfile添加alembic依赖包，修复OpenClaw适配器错误处理 ```
56 lines
1.7 KiB
Python
56 lines
1.7 KiB
Python
from dataclasses import dataclass
|
|
from secrets import compare_digest
|
|
|
|
from fastapi import Header, HTTPException, status
|
|
|
|
from app.core.config import get_settings
|
|
from app.core.constants import HttpHeader
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class ApiPrincipal:
|
|
"""Authenticated service principal derived from server-side configuration."""
|
|
|
|
actor: str
|
|
|
|
|
|
def require_api_key(
|
|
x_api_key: str | None = Header(default=None, alias=HttpHeader.X_API_KEY),
|
|
) -> ApiPrincipal:
|
|
"""Validate the internal API key header and return its service principal."""
|
|
|
|
settings = get_settings()
|
|
if not settings.api_key:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
|
|
detail="API_KEY is required",
|
|
)
|
|
if not x_api_key or not compare_digest(x_api_key, settings.api_key):
|
|
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid API key")
|
|
return ApiPrincipal(actor=settings.api_actor)
|
|
|
|
|
|
def require_approval_api_key(
|
|
x_approval_api_key: str | None = Header(
|
|
default=None,
|
|
alias=HttpHeader.X_APPROVAL_API_KEY,
|
|
),
|
|
) -> ApiPrincipal:
|
|
"""Validate the approval API key and return the approval principal."""
|
|
|
|
settings = get_settings()
|
|
if not settings.approval_api_key:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
|
|
detail="APPROVAL_API_KEY is required",
|
|
)
|
|
if (
|
|
not x_approval_api_key
|
|
or not compare_digest(x_approval_api_key, settings.approval_api_key)
|
|
):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Invalid approval API key",
|
|
)
|
|
return ApiPrincipal(actor=settings.approval_api_actor)
|