colcaroliandClaude Sonnet 5
d207537b53
- Add a password-protected /api/settings endpoint (HTTP Basic auth, backend/app/core/auth.py) backed by a DB-stored allowlist of connection settings (OPENAI_API_KEY, ANTHROPIC_API_KEY, AWS creds, OLLAMA_API_BASE, TAVILY_API_KEY, LOCAL_KB_EMBEDDING_MODEL). Saved values override .env and apply immediately via os.environ, so Lightsail deployments no longer need SSH + `.env` edits to rotate keys. Values are always returned masked to the frontend. - Replace ModelSelector.vue's hardcoded model list with a DB-backed /api/models CRUD API (read is public, writes reuse the settings password) so the chat model dropdown can be edited from the GUI; seed it once with the previous hardcoded presets on first boot. - Fix local_knowledge.py reading LOCAL_KB_EMBEDDING_MODEL once at import time instead of per-call, which would have silently ignored GUI/DB overrides for the embedding model. - Add SettingsPanel.vue (API keys + model management UI) and document the new SETTINGS_PASSWORD env var in .env.example and the Lightsail deploy guide. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
24 lines
891 B
Python
24 lines
891 B
Python
import secrets
|
|
|
|
from fastapi import Depends, HTTPException
|
|
from fastapi.security import HTTPBasic, HTTPBasicCredentials
|
|
|
|
from app.core.config import SETTINGS_PASSWORD
|
|
|
|
_security = HTTPBasic()
|
|
|
|
|
|
def require_settings_password(credentials: HTTPBasicCredentials = Depends(_security)) -> None:
|
|
"""設定画面（/api/settings）専用の簡易パスワード認証。ユーザー名は見ない。
|
|
|
|
SETTINGS_PASSWORD が未設定の場合は、空パスワードでの突破を防ぐため常に拒否する。
|
|
"""
|
|
if not SETTINGS_PASSWORD:
|
|
raise HTTPException(status_code=403, detail="SETTINGS_PASSWORD is not configured on the server")
|
|
if not secrets.compare_digest(credentials.password, SETTINGS_PASSWORD):
|
|
raise HTTPException(
|
|
status_code=401,
|
|
detail="Invalid password",
|
|
headers={"WWW-Authenticate": "Basic"},
|
|
)
|