first commit

backend/app/api_key_auth.py

@@ -0,0 +1,63 @@
+import uuid
+from datetime import datetime, timezone
+
+from fastapi import Depends, Header, HTTPException, status
+from sqlalchemy import select
+from sqlalchemy.orm import Session, joinedload
+
+from .api_keys_service import KEY_PREFIX, parse_api_token, verify_api_token
+from .database import get_db
+from .models import ApiKey, UserAccount
+
+
+def _extract_api_key(
+    authorization: str | None,
+    x_api_key: str | None,
+) -> str | None:
+    if x_api_key:
+        return x_api_key.strip()
+    if authorization and authorization.lower().startswith("bearer "):
+        return authorization[7:].strip()
+    return None
+
+
+def current_api_key(
+    authorization: str | None = Header(default=None),
+    x_api_key: str | None = Header(default=None, alias="X-Api-Key"),
+    db: Session = Depends(get_db),
+) -> ApiKey:
+    token = _extract_api_key(authorization, x_api_key)
+    if not token or not token.startswith(KEY_PREFIX):
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Valid API key required")
+
+    parsed = parse_api_token(token)
+    if parsed:
+        key_id, _ = parsed
+        api_key = db.scalar(
+            select(ApiKey)
+            .options(joinedload(ApiKey.user))
+            .where(ApiKey.id == key_id, ApiKey.revoked_at.is_(None))
+        )
+        if api_key and verify_api_token(token, api_key.key_hash):
+            api_key.last_used_at = datetime.now(timezone.utc)
+            db.commit()
+            return api_key
+
+    active_keys = db.scalars(
+        select(ApiKey)
+        .options(joinedload(ApiKey.user))
+        .where(ApiKey.revoked_at.is_(None))
+    ).all()
+    for api_key in active_keys:
+        if verify_api_token(token, api_key.key_hash):
+            api_key.last_used_at = datetime.now(timezone.utc)
+            db.commit()
+            return api_key
+
+    raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid API key")
+
+
+def current_api_user(api_key: ApiKey = Depends(current_api_key)) -> UserAccount:
+    if api_key.user.status != "active":
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Account unavailable")
+    return api_key.user