580d7f0e0d
Base login now requests only openid/email/profile (non-sensitive), so a new user gets a clean Google consent with no "unverified app" warning and no 7-day refresh token expiry. YouTube read (youtube.readonly) and write (youtube) are granted later by the onboarding wizard via a parameterized /auth/upgrade?access=read|write. Security fixes folded in from the baseline audit: - config: refuse to boot in production (https OAUTH_REDIRECT_URL) with the placeholder/short SECRET_KEY or a missing TOKEN_ENCRYPTION_KEY, closing a session-forgery / admin-impersonation hole. - main: mark the session cookie Secure when served over HTTPS. - me: expose can_read; sync/subscriptions returns a friendly 403 (not a 500) until YouTube read access is granted.
91 lines
2.8 KiB
Python
91 lines
2.8 KiB
Python
import logging
|
|
import sys
|
|
from contextlib import asynccontextmanager
|
|
from pathlib import Path
|
|
|
|
from fastapi import FastAPI, HTTPException
|
|
|
|
# When started via uvicorn --log-config the "subfeed" logger is already configured
|
|
# (see log_config.json). This block is a timestamped fallback for other entrypoints
|
|
# (tests, scripts) so our logs are never silently dropped.
|
|
_subfeed_logger = logging.getLogger("subfeed")
|
|
if not _subfeed_logger.handlers:
|
|
_handler = logging.StreamHandler(sys.stdout)
|
|
_handler.setFormatter(
|
|
logging.Formatter("%(asctime)s %(levelname)-5s [%(name)s] %(message)s")
|
|
)
|
|
_subfeed_logger.addHandler(_handler)
|
|
_subfeed_logger.setLevel(logging.INFO)
|
|
_subfeed_logger.propagate = False
|
|
|
|
log = logging.getLogger("subfeed.app")
|
|
from fastapi.middleware.cors import CORSMiddleware
|
|
from fastapi.responses import FileResponse
|
|
from fastapi.staticfiles import StaticFiles
|
|
from starlette.middleware.sessions import SessionMiddleware
|
|
|
|
from app import auth
|
|
from app.config import settings
|
|
from app.routes import admin, channels, feed, health, me, quota, sync, tags
|
|
from app.scheduler import shutdown_scheduler, start_scheduler
|
|
|
|
|
|
@asynccontextmanager
|
|
async def lifespan(app: FastAPI):
|
|
log.info("Subfeed starting up")
|
|
start_scheduler()
|
|
try:
|
|
yield
|
|
finally:
|
|
log.info("Subfeed shutting down")
|
|
shutdown_scheduler()
|
|
|
|
|
|
app = FastAPI(title=settings.app_name, lifespan=lifespan)
|
|
|
|
app.add_middleware(
|
|
SessionMiddleware,
|
|
secret_key=settings.secret_key,
|
|
same_site="lax", # required so the cookie rides the OAuth redirect back from Google
|
|
https_only=settings.session_https_only, # Secure flag when served over HTTPS (prod)
|
|
)
|
|
|
|
if settings.frontend_origin:
|
|
app.add_middleware(
|
|
CORSMiddleware,
|
|
allow_origins=[settings.frontend_origin],
|
|
allow_credentials=True,
|
|
allow_methods=["*"],
|
|
allow_headers=["*"],
|
|
)
|
|
|
|
app.include_router(health.router)
|
|
app.include_router(auth.router)
|
|
app.include_router(sync.router)
|
|
app.include_router(tags.router)
|
|
app.include_router(feed.router)
|
|
app.include_router(me.router)
|
|
app.include_router(channels.router)
|
|
app.include_router(admin.router)
|
|
app.include_router(quota.router)
|
|
|
|
# The built SPA (populated by the Docker frontend build stage).
|
|
STATIC_DIR = Path(__file__).parent / "static_spa"
|
|
app.mount(
|
|
"/assets",
|
|
StaticFiles(directory=STATIC_DIR / "assets", check_dir=False),
|
|
name="assets",
|
|
)
|
|
|
|
|
|
@app.get("/")
|
|
async def index() -> FileResponse:
|
|
return FileResponse(STATIC_DIR / "index.html")
|
|
|
|
|
|
@app.get("/{full_path:path}")
|
|
async def spa_fallback(full_path: str) -> FileResponse:
|
|
# Client-side routes fall back to index.html; real API/asset paths are matched above.
|
|
if full_path.startswith(("api/", "auth/", "healthz", "assets/")):
|
|
raise HTTPException(status_code=404)
|
|
return FileResponse(STATIC_DIR / "index.html")
|