Method dispatch

fastapi_app/middleware/api_key.py:328–428

(self, request: Request, call_next)

    """

    async def dispatch(self, request: Request, call_next):
        path = request.url.path

        # CORS preflight requests do not include custom auth headers.
        # Let CORSMiddleware handle them.
        if request.method == "OPTIONS":
            return await call_next(request)

        if _is_blocked_public_output_path(path):
            return Response(status_code=404)

        # Skip excluded paths
        if path in EXCLUDED_PATHS:
            return await call_next(request)

        # Skip excluded prefixes
        if path.startswith(EXCLUDED_PREFIXES):
            return await call_next(request)

        client_ip = _extract_client_ip(request)
        request.state.client_ip = client_ip

        if (
            settings.SECURITY_RATE_LIMIT_ENABLED
            and request.method in _WRITE_METHODS
            and _should_check_api_key(path)
        ):
            if _is_rate_limited(client_ip, _DEFAULT_WRITE_RULE):
                return JSONResponse(
                    status_code=429,
                    content={"detail": "Too many write requests from this IP. Please retry later."},
                )
            specific_rule = _RATE_LIMIT_RULES.get(path)
            if specific_rule and _is_rate_limited(client_ip, specific_rule):
                return JSONResponse(
                    status_code=429,
                    content={"detail": "Rate limit exceeded for this endpoint. Please retry later."},
                )

        # Only check API key for /api/* and /paper2video/* routes
        if _should_check_api_key(path):
            if not API_KEY:
                return JSONResponse(
                    status_code=500,
                    content={"detail": "BACKEND_API_KEY is not configured"},
                )
            api_key = request.headers.get("X-API-Key")
            # EventSource cannot set custom headers, allow query param for rebuttal SSE.
            if not api_key and request.method == "GET" and "/paper2rebuttal/progress/" in path:
                api_key = request.query_params.get("x_api_key") or request.query_params.get("X-API-Key")

            if not api_key:
                return JSONResponse(
                    status_code=401,
                    content={"detail": "API key required"},
                )

            if api_key != API_KEY: