admin/openfang
1
0
Fork 0
mirror of https://github.com/RightNow-AI/openfang.git synced 2026-07-30 23:05:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix auth

Browse Source
This commit is contained in:
jaberjaber23
2026-03-09 03:19:14 +03:00
parent 487555a5e5
commit a00327abe9
2 changed files with 18 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Cargo.lock
Generated
+14 -14
View File
@@ -3875,7 +3875,7 @@ dependencies = [
[[package]]
name = "openfang-api"
version = "0.3.32"
version = "0.3.33"
dependencies = [
"async-trait",
"axum",
@@ -3912,7 +3912,7 @@ dependencies = [
[[package]]
name = "openfang-channels"
version = "0.3.32"
version = "0.3.33"
dependencies = [
"async-trait",
"axum",
@@ -3944,7 +3944,7 @@ dependencies = [
[[package]]
name = "openfang-cli"
version = "0.3.32"
version = "0.3.33"
dependencies = [
"clap",
"clap_complete",
@@ -3971,7 +3971,7 @@ dependencies = [
[[package]]
name = "openfang-desktop"
version = "0.3.32"
version = "0.3.33"
dependencies = [
"axum",
"open",
@@ -3997,7 +3997,7 @@ dependencies = [
[[package]]
name = "openfang-extensions"
version = "0.3.32"
version = "0.3.33"
dependencies = [
"aes-gcm",
"argon2",
@@ -4025,7 +4025,7 @@ dependencies = [
[[package]]
name = "openfang-hands"
version = "0.3.32"
version = "0.3.33"
dependencies = [
"chrono",
"dashmap",
@@ -4042,7 +4042,7 @@ dependencies = [
[[package]]
name = "openfang-kernel"
version = "0.3.32"
version = "0.3.33"
dependencies = [
"async-trait",
"chrono",
@@ -4078,7 +4078,7 @@ dependencies = [
[[package]]
name = "openfang-memory"
version = "0.3.32"
version = "0.3.33"
dependencies = [
"async-trait",
"chrono",
@@ -4097,7 +4097,7 @@ dependencies = [
[[package]]
name = "openfang-migrate"
version = "0.3.32"
version = "0.3.33"
dependencies = [
"chrono",
"dirs 6.0.0",
@@ -4116,7 +4116,7 @@ dependencies = [
[[package]]
name = "openfang-runtime"
version = "0.3.32"
version = "0.3.33"
dependencies = [
"anyhow",
"async-trait",
@@ -4150,7 +4150,7 @@ dependencies = [
[[package]]
name = "openfang-skills"
version = "0.3.32"
version = "0.3.33"
dependencies = [
"chrono",
"hex",
@@ -4173,7 +4173,7 @@ dependencies = [
[[package]]
name = "openfang-types"
version = "0.3.32"
version = "0.3.33"
dependencies = [
"async-trait",
"chrono",
@@ -4192,7 +4192,7 @@ dependencies = [
[[package]]
name = "openfang-wire"
version = "0.3.32"
version = "0.3.33"
dependencies = [
"async-trait",
"chrono",
@@ -8821,7 +8821,7 @@ checksum = "b9cc00251562a284751c9973bace760d86c0276c471b4be569fe6b068ee97a56"
[[package]]
name = "xtask"
version = "0.3.32"
version = "0.3.33"
[[package]]
name = "yoke"
crates/openfang-api/src/middleware.rs
+4 -18
View File
@@ -119,25 +119,11 @@ pub async fn auth(
return next.run(request).await;
}
// SECURITY: If no API key configured, allow localhost access but reject remote.
// Many users skip the wizard or create config.toml manually without setting api_key.
// Blocking localhost access makes the dashboard unusable for them.
// If no API key configured, skip auth entirely.
// Users who don't set api_key accept that all endpoints are open.
// To secure the dashboard, set api_key in config.toml.
if api_key.is_empty() {
let is_loopback = request
.extensions()
.get::<axum::extract::ConnectInfo<std::net::SocketAddr>>()
.map(|ci| ci.0.ip().is_loopback())
.unwrap_or(false);
if is_loopback {
return next.run(request).await;
}
return Response::builder()
.status(StatusCode::UNAUTHORIZED)
.header("www-authenticate", "Bearer")
.body(Body::from(
serde_json::json!({"error": "No API key configured. Set api_key in config.toml or pass --api-key on startup."}).to_string(),
))
.unwrap_or_default();
return next.run(request).await;
}
// Check Authorization: Bearer <token> header, then fallback to X-API-Key