kin: BATON-005-backend_dev

backend/middleware.py

@@ -2,11 +2,15 @@ from __future__ import annotations
 
 import secrets
 import time
+from typing import Optional
 
-from fastapi import Header, HTTPException, Request
+from fastapi import Depends, Header, HTTPException, Request
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 
 from backend import config
 
+_bearer = HTTPBearer(auto_error=False)
+
 _RATE_LIMIT = 5
 _RATE_WINDOW = 600  # 10 minutes
 
@@ -20,6 +24,15 @@ async def verify_webhook_secret(
         raise HTTPException(status_code=403, detail="Forbidden")
 
 
+async def verify_admin_token(
+    credentials: Optional[HTTPAuthorizationCredentials] = Depends(_bearer),
+) -> None:
+    if credentials is None or not secrets.compare_digest(
+        credentials.credentials, config.ADMIN_TOKEN
+    ):
+        raise HTTPException(status_code=401, detail="Unauthorized")
+
+
 async def rate_limit_register(request: Request) -> None:
     counters = request.app.state.rate_counters
     client_ip = request.client.host if request.client else "unknown"