From 8607169546053ac42f9f8e65c3aa4da249f430ea Mon Sep 17 00:00:00 2001 From: orbisai0security Date: Tue, 5 May 2026 07:51:07 +0000 Subject: [PATCH] fix: V-001 security vulnerability Automated security fix generated by Orbis Security AI --- scripts/serve_openai_api.py | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/scripts/serve_openai_api.py b/scripts/serve_openai_api.py index 0550d4a..c4ccc8e 100644 --- a/scripts/serve_openai_api.py +++ b/scripts/serve_openai_api.py @@ -13,8 +13,9 @@ import uvicorn from threading import Thread from queue import Queue -from fastapi import FastAPI, HTTPException +from fastapi import FastAPI, HTTPException, Depends from fastapi.responses import StreamingResponse +from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials from pydantic import BaseModel from transformers import AutoTokenizer, AutoModelForCausalLM, TextStreamer from model.model_minimind import MiniMindConfig, MiniMindForCausalLM @@ -24,6 +25,14 @@ warnings.filterwarnings('ignore') app = FastAPI() +_security = HTTPBearer(auto_error=False) + + +def _verify_api_key(credentials: HTTPAuthorizationCredentials = Depends(_security)): + api_key = os.environ.get("MINIMIND_API_KEY") + if api_key and (credentials is None or credentials.credentials != api_key): + raise HTTPException(status_code=401, detail="Invalid or missing API key") + def init_model(args): tokenizer = AutoTokenizer.from_pretrained(args.load_from) @@ -169,7 +178,7 @@ def generate_stream_response(messages, temperature, top_p, max_tokens, tools=Non @app.post("/v1/chat/completions") -async def chat_completions(request: ChatRequest): +async def chat_completions(request: ChatRequest, _: None = Depends(_verify_api_key)): try: if request.stream: return StreamingResponse(