Update auth.py

auth.py

@@ -1,34 +1,44 @@
 from fastapi import Header, HTTPException
+from firebase_admin import firestore
 import time
 
-# ⚡ Demo in-memory keys (replace with DB later)
-API_KEYS = {
-    "free_key_123": {"plan": "free", "limit": 100},
-    "pro_key_456": {"plan": "pro", "limit": 10000},
-}
+db = firestore.client()
 
-request_log = {}
+# in-memory rate tracking (later move to Redis)
+REQUEST_LOG = {}
 
 
 def verify_api_key(x_api_key: str = Header(...)):
-    if x_api_key not in API_KEYS:
-        raise HTTPException(status_code=401, detail="Invalid API Key")
+    # 1. Check key exists
+    doc = db.collection("api_keys").document(x_api_key).get()
 
-    plan = API_KEYS[x_api_key]["plan"]
-    limit = API_KEYS[x_api_key]["limit"]
+    if not doc.exists:
+        raise HTTPException(status_code=401, detail="Invalid API key")
 
+    data = doc.to_dict()
+
+    # 2. Check active
+    if not data.get("active", False):
+        raise HTTPException(status_code=403, detail="API key disabled")
+
+    plan = data.get("plan", "pro")
+    limit = data.get("limit", 50000)
+
+    # 3. Rate limit
     now = int(time.time())
-    window = 60  # 1 minute window
+    window = 60  # 1 min
 
-    logs = request_log.get(x_api_key, [])
+    logs = REQUEST_LOG.get(x_api_key, [])
     logs = [t for t in logs if now - t < window]
 
     if len(logs) >= limit:
         raise HTTPException(
             status_code=429,
-            detail=f"Rate limit exceeded for {plan} plan"
+            detail=f"Rate limit exceeded ({plan} plan)"
         )
 
     logs.append(now)
-    request_log[x_api_key] = logs
-    return True
+    REQUEST_LOG[x_api_key] = logs
+
+    return data
+