LCjVdZddlZddlmZmZmZddlmZddlm Z ddl m Z m Z ddl mZe ZeeZedd d fd ed efdZGddZded efdZy)u Security primitives: API key authentication and rate limiting. For a client-facing production system, you need at minimum: 1. API key auth — so only authorized callers (the client's frontend/app) can hit your endpoints. Without this, anyone who finds your server's IP can hammer your LLM budget and ML compute for free. 2. Rate limiting — prevents both abuse and accidental self-DoS (e.g. a buggy frontend retry loop). This is deliberately simple (static API keys + Redis-backed rate limiter) rather than full OAuth2/JWT, because the brief is a backend service consumed by the client's own application, not a multi-tenant public API. If the client later needs per-user auth, JWT can be layered on top of this without restructuring anything. N)Header HTTPExceptionRequest)Redis) get_settings)AuthenticationErrorRateLimitExceededError) get_logger.z X-API-KeyzClient API key)alias description x_api_keyreturncKtj}|s4tjr"tj dt dd|S||vr!tj dt d|Sw)z Dependency injected into every protected route. Rejects the request before any business logic runs if the key is invalid. z0No API keys configured in production environmentz'Service misconfigured. Contact support.z%VALID_API_KEYS is empty in production)messagedetailz%Rejected request with invalid API keyzInvalid or missing API key)r)settingsvalid_api_keys_list is_productionloggercriticalrwarning)r valid_keyss >C:\Crop_Prediction\Backend\crop-ai-system\app\core\security.pyverify_api_keyrsp--J   ! ! OON O%A>  ">?!*FGG sA.A0c0eZdZdZdedefdZdeddfdZy) RedisRateLimiterz Sliding-window rate limiter backed by Redis, so it works correctly across multiple Gunicorn worker processes (in-memory counters would not, since each worker has its own memory). redislimit_per_minutec ||_||_y)N)rlimit)selfrrs r__init__zRedisRateLimiter.__init__As % identifierrNcKd|dttjdz} |jj|d{}|dk(r$|jj |dd{||jkDrtdd|jiy7V7/#t $r"}t jd|Yd}~yd}~wwxYww) Nz ratelimit::<z(Rate limiter Redis error, failing open: z:Too many requests. Please slow down and try again shortly.r)rextra) inttimerincrexpire Exceptionrerrorr r )r!r$keycurrentexcs rcheckzRedisRateLimiter.checkEs:,aDIIK2,=(>'?@  JJOOC00G!|jj''R000 TZZ (T)4::6  10  LLCC5I J   sR'CB#B (B#1B!2B#6)CB#!B## C,C C CC) __name__ __module__ __qualname____doc__rr*r"strr3r#rrr:s- &e&s&cdr#rrequestcK|jjtj}|rd|ddS|jr|jj nd}d|Sw)z Prefer the API key as the rate-limit identifier (per-client fairness) falling back to IP if the key is somehow absent at this layer. zkey:N unknownzip:)headersgetrAPI_KEY_HEADERclienthost)r:api_key client_hosts rget_client_identifierrEXs\ oo!!("9"9:Ggcrl^$$)0'..%%YK  sAA)r7r+fastapirrr redis.asynciorapp.core.configrapp.core.exceptionsrr app.core.logging_configr rr4rr8rrrEr9r#rrKss" 22(K. > H C{@PQ6<  S r#