esotericelf/image_edit_creation

1import os2import secrets3from datetime import datetime, timedelta, timezone4 5from fastapi import HTTPException, Request, Response6from itsdangerous import BadSignature, SignatureExpired, URLSafeTimedSerializer7 8ADMIN_SESSION_COOKIE = "admin_session"9SESSION_MAX_AGE_SECONDS = 60 * 60 * 12  # 12 hours10 11 12def get_admin_session_secret() -> str | None:13    secret = (os.getenv("ADMIN_SESSION_SECRET") or "").strip()14    if len(secret) > 0:15        return secret16    return None17 18 19def is_admin_session_configured() -> bool:20    return get_admin_session_secret() is not None21 22 23def _serializer() -> URLSafeTimedSerializer:24    secret = get_admin_session_secret()25    if secret is None:26        raise RuntimeError("ADMIN_SESSION_SECRET environment variable is not configured.")27    return URLSafeTimedSerializer(secret_key=secret, salt="nano-banana-admin")28 29 30def verify_master_password(password: str) -> bool:31    master = (os.getenv("MASTER_PASSWORD") or "").strip()32    if len(master) == 0:33        return False34    return secrets.compare_digest(password, master)35 36 37def create_admin_session_token() -> str:38    payload = {39        "role": "admin",40        "issued_at": datetime.now(timezone.utc).isoformat(),41        "nonce": secrets.token_hex(16),42    }43    return _serializer().dumps(payload)44 45 46def set_admin_session_cookie(response: Response, token: str) -> None:47    secure = os.getenv("COOKIE_SECURE", "false").strip().lower() in {48        "1",49        "true",50        "yes",51        "on",52    }53    response.set_cookie(54        key=ADMIN_SESSION_COOKIE,55        value=token,56        httponly=True,57        secure=secure,58        samesite="none" if secure else "lax",59        max_age=SESSION_MAX_AGE_SECONDS,60        path="/",61    )62 63 64def clear_admin_session_cookie(response: Response) -> None:65    secure = os.getenv("COOKIE_SECURE", "false").strip().lower() in {66        "1",67        "true",68        "yes",69        "on",70    }71    response.delete_cookie(72        key=ADMIN_SESSION_COOKIE,73        path="/",74        secure=secure,75        samesite="none" if secure else "lax",76    )77 78 79def read_admin_session(request: Request) -> bool:80    if not is_admin_session_configured():81        return False82 83    token = request.cookies.get(ADMIN_SESSION_COOKIE)84    if not token:85        return False86    try:87        data = _serializer().loads(token, max_age=SESSION_MAX_AGE_SECONDS)88    except (BadSignature, SignatureExpired, RuntimeError):89        return False90    return isinstance(data, dict) and data.get("role") == "admin"91 92 93def require_admin_session(request: Request) -> None:94    if not read_admin_session(request):95        raise HTTPException(status_code=401, detail="Admin authentication required.")96