From a7692dc89484cae29e051d07f5279c1e04cc929a Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Sat, 18 Jul 2026 21:10:32 +0200
Subject: [PATCH] fix bug in API static tokens where not actually extracted
 from request

---
 api/src/dooris_api/deps.py | 28 +++++++++++++++++++++-------
 1 file changed, 21 insertions(+), 7 deletions(-)

diff --git a/api/src/dooris_api/deps.py b/api/src/dooris_api/deps.py
index 9ca5139..8f65df2 100644
--- a/api/src/dooris_api/deps.py
+++ b/api/src/dooris_api/deps.py
@@ -1,7 +1,7 @@
 from typing import Annotated, Optional
 import logging
 from datetime import datetime, UTC, timedelta
-from fastapi import Request, Depends, Response, Header
+from fastapi import Request, Depends, Response
 from fastapi.security import APIKeyHeader
 from simple_openid_connect.data import TokenSuccessResponse
 from simple_openid_connect.client import OpenidClient
@@ -14,7 +14,12 @@ from dooris_api.ccujack import CCUJackClient
 logger = logging.getLogger(__name__)
 
 
-api_key_security_scheme = APIKeyHeader(name="Authorization", scheme_name="Static-Token", auto_error=False)
+api_key_security_scheme = APIKeyHeader(
+    name="authorization",
+    scheme_name="Static-Token",
+    description="Set the Authorization header to 'Static-Token foobar123' with a token that is statically configured at application parameter",
+    auto_error=False,
+)
 
 
 async def get_oidc_client(req: Request) -> OpenidClient:
@@ -134,14 +139,17 @@ def clear_oidc_auth_state(resp: Response):
 
 
 def get_logged_in_token_user(req: Request, token: Optional[str]):
+    print(req.headers)
+    print(token)
+
     if not token or not token.startswith("Static-Token "):
         logger.debug("No static API-Token was part of the request")
         return None
-    
+
     token = token.removeprefix("Static-Token ")
     valid_tokens = app_config.get().static_api_tokens
 
-    if any((i == token for i in valid_tokens)):        
+    if any((i == token for i in valid_tokens)):
         logger.debug("Successfully authenticated a static API-Token")
         return models.ApiUser(
             is_anonymous=False,
@@ -157,7 +165,10 @@ def get_logged_in_token_user(req: Request, token: Optional[str]):
 
 
 async def get_api_user(
-    req: Request, resp: Response, oidc_client: OpenidClient, token: Annotated[Optional[str], Depends(api_key_security_scheme)] = None
+    req: Request,
+    resp: Response,
+    oidc_client: OpenidClient,
+    token: Annotated[Optional[str], Depends(api_key_security_scheme)] = None,
 ) -> models.ApiUser:
     oidc_user = await get_logged_in_oidc_user(req, resp, oidc_client)
     token_user = get_logged_in_token_user(req, token)
@@ -182,9 +193,12 @@ ApiUser = Annotated[models.ApiUser, Depends(get_api_user)]
 
 
 async def get_authenticated_user(
-    req: Request, resp: Response, oidc_client: OpenidClient
+    req: Request,
+    resp: Response,
+    oidc_client: OpenidClient,
+    token: Annotated[Optional[str], Depends(api_key_security_scheme)] = None,
 ) -> models.ApiUser:
-    user = await get_api_user(req, resp, oidc_client)
+    user = await get_api_user(req, resp, oidc_client, token)
     if user.is_anonymous:
         raise exceptions.HttpProblemException.unauthorized(req.url)
     else: