default
7d6040af41
- Batch device CRUD: POST /api/devices/batch (create 500), PUT /api/devices/batch (update 500), POST /api/devices/batch-delete (delete 100) with WHERE IN bulk queries - Batch command: POST /api/commands/batch with model_validator mutual exclusion - API key auth (X-API-Key header, secrets.compare_digest timing-safe) - Rate limiting via SlowAPIMiddleware (60/min default, 30/min writes) - Real client IP extraction (X-Forwarded-For / CF-Connecting-IP) - Global exception handler (no stack trace leaks, passes HTTPException through) - CORS with auto-disable credentials on wildcard origins - Schema validation: IMEI pattern, lat/lon ranges, Literal enums, MAC/UUID patterns - Heartbeats router, per-ID endpoints for locations/attendance/bluetooth - Input dedup in batch create, result ordering preserved - Baidu reverse geocoding, Gaode map tiles with WGS84→GCJ02 conversion - Device detail panel with feature toggles and command controls - Side panel for location/beacon pages with auto-select active device via [HAPI](https://hapi.run) Co-Authored-By: HAPI <noreply@hapi.run>
21 lines
601 B
Python
21 lines
601 B
Python
"""
|
|
Shared FastAPI dependencies.
|
|
"""
|
|
|
|
import secrets
|
|
|
|
from fastapi import HTTPException, Security
|
|
from fastapi.security import APIKeyHeader
|
|
|
|
from app.config import settings
|
|
|
|
_api_key_header = APIKeyHeader(name="X-API-Key", auto_error=False)
|
|
|
|
|
|
async def verify_api_key(api_key: str | None = Security(_api_key_header)):
|
|
"""Verify API key if authentication is enabled."""
|
|
if settings.API_KEY is None:
|
|
return # Auth disabled
|
|
if api_key is None or not secrets.compare_digest(api_key, settings.API_KEY):
|
|
raise HTTPException(status_code=401, detail="Invalid or missing API key")
|