From 8e7140e25602dc60c6bf2440dba3754ebe4573e3 Mon Sep 17 00:00:00 2001 From: Deniz Ulker <156104354+uelkerd@users.noreply.github.com> Date: Wed, 10 Sep 2025 13:49:08 +0300 Subject: [PATCH 1/2] feat: add API middleware for authentication and rate limiting - PR-6 initial implementation --- src/security/auth.py | 45 ++++++++++++++++++++++++++++++++++++ src/security/rate_limiter.py | 31 +++++++++++++++++++++++++ 2 files changed, 76 insertions(+) create mode 100644 src/security/auth.py create mode 100644 src/security/rate_limiter.py diff --git a/src/security/auth.py b/src/security/auth.py new file mode 100644 index 000000000..7227f176b --- /dev/null +++ b/src/security/auth.py @@ -0,0 +1,45 @@ +from fastapi import Depends, HTTPException, status +from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials +from jose import JWTError, jwt +from passlib.context import CryptContext +from datetime import datetime, timedelta +from typing import Optional + +# Security settings +SECRET_KEY = "your-secret-key" # Should be loaded from config +ALGORITHM = "HS256" +ACCESS_TOKEN_EXPIRE_MINUTES = 30 + +pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto") +security = HTTPBearer() + +def verify_password(plain_password, hashed_password): + return pwd_context.verify(plain_password, hashed_password) + +def get_password_hash(password): + return pwd_context.hash(password) + +def create_access_token(data: dict, expires_delta: Optional[timedelta] = None): + to_encode = data.copy() + if expires_delta: + expire = datetime.utcnow() + expires_delta + else: + expire = datetime.utcnow() + timedelta(minutes=15) + to_encode.update({"exp": expire}) + encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM) + return encoded_jwt + +async def get_current_user(credentials: HTTPAuthorizationCredentials = Depends(security)): + credentials_exception = HTTPException( + status_code=status.HTTP_401_UNAUTHORIZED, + detail="Could not validate credentials", + headers={"WWW-Authenticate": "Bearer"}, + ) + try: + payload = jwt.decode(credentials.credentials, SECRET_KEY, algorithms=[ALGORITHM]) + username: str = payload.get("sub") + if username is None: + raise credentials_exception + except JWTError: + raise credentials_exception + return username \ No newline at end of file diff --git a/src/security/rate_limiter.py b/src/security/rate_limiter.py new file mode 100644 index 000000000..fff3de18c --- /dev/null +++ b/src/security/rate_limiter.py @@ -0,0 +1,31 @@ +from collections import defaultdict +from datetime import datetime, timedelta +from typing import Optional +import time + +class RateLimiter: + def __init__(self, max_requests: int = 100, window_seconds: int = 3600): + self.max_requests = max_requests + self.window_seconds = window_seconds + self.requests = defaultdict(list) + + def is_allowed(self, identifier: str) -> bool: + now = time.time() + window_start = now - self.window_seconds + self.requests[identifier] = [ + timestamp for timestamp in self.requests[identifier] + if timestamp > window_start + ] + if len(self.requests[identifier]) < self.max_requests: + self.requests[identifier].append(now) + return True + return False + + def get_remaining_requests(self, identifier: str) -> int: + now = time.time() + window_start = now - self.window_seconds + self.requests[identifier] = [ + timestamp for timestamp in self.requests[identifier] + if timestamp > window_start + ] + return max(0, self.max_requests - len(self.requests[identifier])) \ No newline at end of file From d6e125ff3c15d2b6969ac350fbf30c525fb371f9 Mon Sep 17 00:00:00 2001 From: Deniz Ulker <156104354+uelkerd@users.noreply.github.com> Date: Wed, 10 Sep 2025 15:27:56 +0300 Subject: [PATCH 2/2] feat: add API middleware for CORS, security, rate limiting - PR-6 --- src/auth.py | 11 +++++++++++ src/rate_limiter.py | 21 +++++++++++++++++++++ src/unified_api_server.py | 20 ++++++++++++++++++++ 3 files changed, 52 insertions(+) create mode 100644 src/auth.py create mode 100644 src/rate_limiter.py create mode 100644 src/unified_api_server.py diff --git a/src/auth.py b/src/auth.py new file mode 100644 index 000000000..d49fa6080 --- /dev/null +++ b/src/auth.py @@ -0,0 +1,11 @@ +from functools import wraps +from flask import request, jsonify + +def require_api_key(f): + @wraps(f) + def decorated_function(*args, **kwargs): + api_key = request.headers.get('X-API-Key') + if api_key != 'your-secret-key': # Replace with actual key or env var + return jsonify({'error': 'API key required'}), 401 + return f(*args, **kwargs) + return decorated_function diff --git a/src/rate_limiter.py b/src/rate_limiter.py new file mode 100644 index 000000000..18968f4db --- /dev/null +++ b/src/rate_limiter.py @@ -0,0 +1,21 @@ +from collections import defaultdict +from datetime import datetime, timedelta +from flask import abort, current_app + +# Simple rate limiter using memory (use Redis for production) +rate_limit = defaultdict(list) + +def rate_limit(max_requests=100, window_minutes=1): + def decorator(f): + @wraps(f) + def decorated_function(*args, **kwargs): + client_ip = request.remote_addr + now = datetime.utcnow() + window_start = now - timedelta(minutes=window_minutes) + rate_limit[client_ip] = [req_time for req_time in rate_limit[client_ip] if req_time > window_start] + if len(rate_limit[client_ip]) >= max_requests: + abort(429, description="Rate limit exceeded") + rate_limit[client_ip].append(now) + return f(*args, **kwargs) + return decorated_function + return decorator diff --git a/src/unified_api_server.py b/src/unified_api_server.py new file mode 100644 index 000000000..3223be317 --- /dev/null +++ b/src/unified_api_server.py @@ -0,0 +1,20 @@ +from flask import Flask, jsonify +from flask_cors import CORS +from auth import require_api_key +from rate_limiter import rate_limit + +app = Flask(__name__) +CORS(app) # Enable CORS for all routes + +@app.route('/api/health') +def health(): + return jsonify({'status': 'healthy'}) + +@app.route('/api/protected', methods=['POST']) +@require_api_key +@rate_limit(max_requests=10, window_minutes=1) +def protected(): + return jsonify({'message': 'Protected endpoint'}) + +if __name__ == '__main__': + app.run(host='0.0.0.0', port=5000)