增加鉴权系统

auth.py

@@ -0,0 +1,45 @@
+from dataclasses import dataclass
+import hmac
+from typing import Annotated
+
+from fastapi import Depends, HTTPException, Request, Security, status
+from fastapi.security import APIKeyHeader
+
+api_key_header = APIKeyHeader(name="X-API-Key", auto_error=False)
+
+
+@dataclass(frozen=True, slots=True)
+class AuthenticatedUser:
+    user_id: str
+
+
+class ApiKeyAuthenticator:
+    def __init__(self, whitelist: dict[str, str]) -> None:
+        if not whitelist:
+            raise ValueError("API_KEY_WHITELIST must contain at least one user")
+        self._whitelist = whitelist.copy()
+
+    def authenticate(self, api_key: str | None) -> AuthenticatedUser | None:
+        if not api_key:
+            return None
+        for user_id, allowed_key in self._whitelist.items():
+            if hmac.compare_digest(api_key, allowed_key):
+                return AuthenticatedUser(user_id=user_id)
+        return None
+
+
+async def require_api_key(
+    request: Request,
+    api_key: Annotated[str | None, Security(api_key_header)],
+) -> AuthenticatedUser:
+    authenticator: ApiKeyAuthenticator = request.app.state.authenticator
+    user = authenticator.authenticate(api_key)
+    if user is None:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="api_key is required",
+        )
+    return user
+
+
+CurrentUser = Annotated[AuthenticatedUser, Depends(require_api_key)]