added web service

web/backend/app/core/auth.py

@@ -0,0 +1,30 @@
+from fastapi import Depends, HTTPException, Security, status
+from fastapi.security import APIKeyHeader, HTTPAuthorizationCredentials, HTTPBearer
+
+from app.core.config import get_settings
+
+_bearer = HTTPBearer(auto_error=False)
+_api_key = APIKeyHeader(name="X-API-Token", auto_error=False)
+
+
+def require_token(
+    bearer: HTTPAuthorizationCredentials | None = Security(_bearer),
+    api_key: str | None = Security(_api_key),
+) -> None:
+    settings = get_settings()
+    expected = settings.api_token
+    if not expected:
+        return
+    token = None
+    if bearer and bearer.credentials:
+        token = bearer.credentials
+    elif api_key:
+        token = api_key
+    if token != expected:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or missing API token",
+        )
+
+
+AuthDep = Depends(require_token)