c1941ed9ac
Auth / token storage: - JWT is now set as an httpOnly Secure SameSite=Lax cookie on login - Add POST /auth/logout endpoint that clears the cookie - get_current_member falls back to rh_token cookie when no Authorization header - WebSocket auth now accepts cookie (rh_token) or optional ?token= query param - Frontend removes all localStorage JWT access; uses credentials:"include" on every fetch so the httpOnly cookie is sent automatically - Replace clearToken() with logout() that calls the server logout endpoint - Non-sensitive rh_session flag in localStorage used only for client-side routing Rate limiting: - Add slowapi>=0.1.9 dependency - /auth/login limited to 10 req/min per IP - /auth/register limited to 5 req/min per IP Nginx security headers: - Add X-Frame-Options, X-Content-Type-Options, Referrer-Policy, X-XSS-Protection, Permissions-Policy to all responses SSE error leakage: - songs.py nc-scan/stream no longer leaks str(exc) to clients Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
95 lines
2.9 KiB
Python
95 lines
2.9 KiB
Python
"""RehearsalHub FastAPI application entry point."""
|
|
|
|
from contextlib import asynccontextmanager
|
|
import os
|
|
|
|
from fastapi import FastAPI, Request, Response
|
|
from fastapi.middleware.cors import CORSMiddleware
|
|
from fastapi.staticfiles import StaticFiles
|
|
from slowapi import Limiter, _rate_limit_exceeded_handler
|
|
from slowapi.errors import RateLimitExceeded
|
|
from slowapi.util import get_remote_address
|
|
|
|
from rehearsalhub.config import get_settings
|
|
from rehearsalhub.routers import (
|
|
annotations_router,
|
|
auth_router,
|
|
bands_router,
|
|
internal_router,
|
|
members_router,
|
|
sessions_router,
|
|
songs_router,
|
|
versions_router,
|
|
ws_router,
|
|
)
|
|
|
|
limiter = Limiter(key_func=get_remote_address)
|
|
|
|
|
|
@asynccontextmanager
|
|
async def lifespan(app: FastAPI):
|
|
yield
|
|
# Clean up DB connections on shutdown
|
|
from rehearsalhub.db.engine import get_engine
|
|
|
|
engine = get_engine()
|
|
await engine.dispose()
|
|
|
|
|
|
def create_app() -> FastAPI:
|
|
settings = get_settings()
|
|
|
|
app = FastAPI(
|
|
title="RehearsalHub API",
|
|
version="0.1.0",
|
|
docs_url="/api/docs",
|
|
redoc_url="/api/redoc",
|
|
openapi_url="/api/openapi.json",
|
|
lifespan=lifespan,
|
|
)
|
|
|
|
app.state.limiter = limiter
|
|
app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
|
|
|
|
app.add_middleware(
|
|
CORSMiddleware,
|
|
allow_origins=[f"https://{settings.domain}", "http://localhost:3000"],
|
|
allow_credentials=True,
|
|
allow_methods=["GET", "POST", "PUT", "PATCH", "DELETE"],
|
|
allow_headers=["Authorization", "Content-Type", "Accept"],
|
|
)
|
|
|
|
@app.middleware("http")
|
|
async def security_headers(request: Request, call_next) -> Response:
|
|
response = await call_next(request)
|
|
response.headers["X-Frame-Options"] = "DENY"
|
|
response.headers["X-Content-Type-Options"] = "nosniff"
|
|
response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
|
|
response.headers["X-XSS-Protection"] = "0" # Disable legacy XSS auditor; rely on CSP
|
|
return response
|
|
|
|
prefix = "/api/v1"
|
|
app.include_router(auth_router, prefix=prefix)
|
|
app.include_router(bands_router, prefix=prefix)
|
|
app.include_router(sessions_router, prefix=prefix)
|
|
app.include_router(songs_router, prefix=prefix)
|
|
app.include_router(versions_router, prefix=prefix)
|
|
app.include_router(annotations_router, prefix=prefix)
|
|
app.include_router(members_router, prefix=prefix)
|
|
app.include_router(internal_router, prefix=prefix)
|
|
app.include_router(ws_router) # WebSocket routes don't use /api/v1 prefix
|
|
|
|
@app.get("/api/health")
|
|
async def health():
|
|
return {"status": "ok"}
|
|
|
|
# Mount static files for avatar uploads
|
|
upload_dir = "uploads/avatars"
|
|
os.makedirs(upload_dir, exist_ok=True)
|
|
app.mount("/api/static/avatars", StaticFiles(directory=upload_dir), name="avatars")
|
|
|
|
return app
|
|
|
|
|
|
app = create_app()
|