79c09cede4
OrbStack 라이선스 만료로 Mac mini Docker 서비스를 GPU 서버로 통합. nginx → Caddy 전환, 12개 서브도메인 자동 HTTPS, fail2ban Caddy JSON 연동. 주요 변경: - home-caddy: Caddy 리버스 프록시 (Let's Encrypt 자동 HTTPS) - home-fail2ban: Caddy JSON 로그 기반 보안 모니터링 - home-ddns: Cloudflare DDNS (API 키 .env 분리) - gpu-hub-api/web: AI 백엔드 라우터 + 웹 UI (gpu-services에서 이전) - AI 런타임(Ollama) 내부망 전용, 외부는 gpu-hub 인증 게이트웨이 경유 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
80 lines
1.9 KiB
Python
80 lines
1.9 KiB
Python
from fastapi import APIRouter, Request, Response
|
|
from pydantic import BaseModel
|
|
|
|
from config import settings
|
|
from middleware.auth import (
|
|
check_login_rate_limit,
|
|
create_token,
|
|
record_login_attempt,
|
|
)
|
|
|
|
router = APIRouter(prefix="/auth", tags=["auth"])
|
|
|
|
|
|
class LoginRequest(BaseModel):
|
|
password: str
|
|
|
|
|
|
class LoginResponse(BaseModel):
|
|
role: str
|
|
token: str
|
|
|
|
|
|
@router.post("/login")
|
|
async def login(body: LoginRequest, request: Request, response: Response):
|
|
ip = request.client.host if request.client else "unknown"
|
|
|
|
if not check_login_rate_limit(ip):
|
|
return _error_response(429, "Too many login attempts. Try again in 1 minute.")
|
|
|
|
record_login_attempt(ip)
|
|
|
|
if body.password == settings.owner_password:
|
|
role = "owner"
|
|
elif body.password == settings.guest_password:
|
|
role = "guest"
|
|
else:
|
|
return _error_response(401, "Invalid password")
|
|
|
|
token = create_token(role)
|
|
|
|
# Set httpOnly cookie for web UI
|
|
response.set_cookie(
|
|
key="token",
|
|
value=token,
|
|
httponly=True,
|
|
samesite="lax",
|
|
max_age=settings.jwt_expire_hours * 3600,
|
|
)
|
|
|
|
return LoginResponse(role=role, token=token)
|
|
|
|
|
|
@router.get("/me")
|
|
async def me(request: Request):
|
|
role = getattr(request.state, "role", "anonymous")
|
|
if role == "anonymous":
|
|
return _error_response(401, "Not authenticated")
|
|
return {"role": role}
|
|
|
|
|
|
@router.post("/logout")
|
|
async def logout(response: Response):
|
|
response.delete_cookie("token")
|
|
return {"ok": True}
|
|
|
|
|
|
def _error_response(status_code: int, message: str):
|
|
from fastapi.responses import JSONResponse
|
|
|
|
return JSONResponse(
|
|
status_code=status_code,
|
|
content={
|
|
"error": {
|
|
"message": message,
|
|
"type": "auth_error",
|
|
"code": f"auth_{status_code}",
|
|
}
|
|
},
|
|
)
|