Remove application license gate
This commit is contained in:
@@ -38,29 +38,17 @@ _TRUSTED_PROXY_IPS: frozenset[str] = frozenset(
|
||||
if ip.strip()
|
||||
)
|
||||
from ..database import get_db
|
||||
from ..license_service import check_license
|
||||
from ..models import AuthRateLimitORM, AuthUserORM, DinsarTaskBatchORM, DinsarTaskItemORM, PsTaskBatchORM, PsTaskItemORM
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Path classification constants
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
_LICENSE_EXEMPT_PATHS = {
|
||||
"/api/license/status",
|
||||
"/api/license/upload",
|
||||
"/api/license/refresh",
|
||||
"/api/health",
|
||||
"/api/auth/login",
|
||||
"/api/auth/logout",
|
||||
"/api/auth/me",
|
||||
}
|
||||
|
||||
READ_ONLY_METHODS = {"GET", "HEAD", "OPTIONS"}
|
||||
READ_SAFE_POST_PATHS = {
|
||||
"/api/radar-data/search",
|
||||
}
|
||||
PUBLIC_AUTH_PATHS = {
|
||||
"/api/license/status",
|
||||
"/api/health",
|
||||
"/api/auth/login",
|
||||
"/api/auth/logout",
|
||||
@@ -68,8 +56,6 @@ PUBLIC_AUTH_PATHS = {
|
||||
|
||||
HIGH_RISK_WRITE_PATH_PREFIXES = (
|
||||
"/api/auth/users",
|
||||
"/api/license/upload",
|
||||
"/api/license/refresh",
|
||||
"/api/workflow/runs",
|
||||
"/api/task-batches/",
|
||||
"/api/tools/",
|
||||
@@ -103,13 +89,6 @@ LOGIN_THROTTLE_CLEANUP_INTERVAL_SECONDS = read_int_env(
|
||||
|
||||
_LOGIN_THROTTLE_LOCK = asyncio.Lock()
|
||||
_LOGIN_THROTTLE_LAST_CLEANUP_MONO = 0.0
|
||||
_LICENSE_UPLOAD_LOCK = asyncio.Lock()
|
||||
MAX_LICENSE_UPLOAD_BYTES = read_int_env(
|
||||
"MAX_LICENSE_UPLOAD_BYTES",
|
||||
1024 * 1024,
|
||||
minimum=1024,
|
||||
maximum=20 * 1024 * 1024,
|
||||
)
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Statistics cache
|
||||
@@ -363,24 +342,6 @@ async def _add_operation_audit_log(
|
||||
)
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# License guard
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
def _require_license(request: Request):
|
||||
"""
|
||||
授权校验:未授权时拒绝所有 API。
|
||||
使用精确路径集合匹配,防止 endswith 绕过攻击。
|
||||
"""
|
||||
path = (request.url.path or "").rstrip("/") or "/"
|
||||
if path in _LICENSE_EXEMPT_PATHS:
|
||||
return
|
||||
result = check_license()
|
||||
if not result.get("ok"):
|
||||
raise HTTPException(status_code=403, detail=f"License required: {result.get('reason')}")
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Auth guards
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
Reference in New Issue
Block a user