6bd23e7e8b
- Disable open /api/auth/register endpoint (gateway) - Require gateway session auth on Immich and Karakeep hooks proxies - Replace SHA-256 with bcrypt in fitness service (auth + seed) - Remove hardcoded Telegram user IDs from fitness seed - Add Secure flag to session cookie - Add domain allowlist and content-type validation to image proxy - Strengthen .gitignore (env variants, runtime data, test artifacts)
50 lines
1.5 KiB
Python
50 lines
1.5 KiB
Python
"""
|
|
Platform Gateway — Response helpers mixed into GatewayHandler.
|
|
"""
|
|
|
|
import json
|
|
from http.cookies import SimpleCookie
|
|
|
|
from config import SESSION_MAX_AGE
|
|
from sessions import get_session_user
|
|
|
|
|
|
class ResponseMixin:
|
|
"""Mixin providing response helpers for GatewayHandler."""
|
|
|
|
def _send_json(self, data, status=200):
|
|
body = json.dumps(data).encode()
|
|
self.send_response(status)
|
|
self.send_header("Content-Type", "application/json")
|
|
self.send_header("Content-Length", len(body))
|
|
self.end_headers()
|
|
self.wfile.write(body)
|
|
|
|
def _get_session_token(self):
|
|
cookie = SimpleCookie(self.headers.get("Cookie", ""))
|
|
if "platform_session" in cookie:
|
|
return cookie["platform_session"].value
|
|
auth = self.headers.get("Authorization", "")
|
|
if auth.startswith("Bearer "):
|
|
return auth[7:]
|
|
return None
|
|
|
|
def _get_user(self):
|
|
token = self._get_session_token()
|
|
return get_session_user(token)
|
|
|
|
def _require_auth(self):
|
|
user = self._get_user()
|
|
if not user:
|
|
self._send_json({"error": "Unauthorized"}, 401)
|
|
return None
|
|
return user
|
|
|
|
def _set_session_cookie(self, token):
|
|
self.send_header("Set-Cookie",
|
|
f"platform_session={token}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age={SESSION_MAX_AGE}")
|
|
|
|
def _read_body(self):
|
|
length = int(self.headers.get("Content-Length", 0))
|
|
return self.rfile.read(length) if length > 0 else b""
|