(request: Request, call_next)
| 81 | |
| 82 | @app.middleware("http") |
| 83 | async def require_api_key(request: Request, call_next): |
| 84 | if request.url.path not in _UNPROTECTED: |
| 85 | provided = request.headers.get("X-API-Key", "") |
| 86 | # Constant-time compare so the key can't be recovered via timing. |
| 87 | if not secrets.compare_digest(provided, api_key): |
| 88 | # Return the response directly: an HTTPException raised inside |
| 89 | # BaseHTTPMiddleware is not handled by FastAPI's exception |
| 90 | # handlers and would surface as an uncaught 500. |
| 91 | return JSONResponse( |