Spaces:
Sleeping
Sleeping
| import hmac | |
| import os | |
| from fastapi import Header, HTTPException | |
| def require_service_key(x_service_key: str | None = Header(default=None)) -> None: | |
| """ | |
| Shared-secret gate for the compute endpoints (/extract-resume, /tts). | |
| This service is only ever called by the NestJS backend, but on a public host | |
| it is reachable by anyone — without this, the TTS and extraction compute is | |
| free for whoever finds the URL. | |
| Fails closed: if SERVICE_API_KEY is unset the endpoints refuse traffic | |
| rather than running open, so a missing env var can't silently expose them. | |
| Health checks stay unauthenticated so platform probes keep working. | |
| """ | |
| expected = os.getenv("SERVICE_API_KEY") | |
| if not expected: | |
| raise HTTPException( | |
| status_code=503, | |
| detail="Service authentication is not configured.", | |
| ) | |
| # compare_digest avoids leaking the key through response timing. | |
| if not x_service_key or not hmac.compare_digest(x_service_key, expected): | |
| raise HTTPException(status_code=401, detail="Invalid or missing service key.") | |