Merge 8607169546 into 4a68da72d5

Automated security fix generated by Orbis Security AI

model/model_lora.py

@@ -20,8 +20,8 @@ class LoRA(nn.Module):
 
 def apply_lora(model, rank=16):
     for name, module in model.named_modules():
-        if isinstance(module, nn.Linear) and module.weight.shape[0] == module.weight.shape[1]:
+        if isinstance(module, nn.Linear) and module.in_features == module.out_features:
-            lora = LoRA(module.weight.shape[0], module.weight.shape[1], rank=rank).to(model.device)
+            lora = LoRA(module.in_features, module.out_features, rank=rank).to(model.device)
             setattr(module, "lora", lora)
             original_forward = module.forward
 

scripts/serve_openai_api.py

@@ -13,8 +13,9 @@ import uvicorn
 
 from threading import Thread
 from queue import Queue
-from fastapi import FastAPI, HTTPException
+from fastapi import FastAPI, HTTPException, Depends
 from fastapi.responses import StreamingResponse
+from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
 from pydantic import BaseModel
 from transformers import AutoTokenizer, AutoModelForCausalLM, TextStreamer
 from model.model_minimind import MiniMindConfig, MiniMindForCausalLM
@@ -24,6 +25,14 @@ warnings.filterwarnings('ignore')
 
 app = FastAPI()
 
+_security = HTTPBearer(auto_error=False)
+
+
+def _verify_api_key(credentials: HTTPAuthorizationCredentials = Depends(_security)):
+    api_key = os.environ.get("MINIMIND_API_KEY")
+    if api_key and (credentials is None or credentials.credentials != api_key):
+        raise HTTPException(status_code=401, detail="Invalid or missing API key")
+
 
 def init_model(args):
     tokenizer = AutoTokenizer.from_pretrained(args.load_from)
@@ -169,7 +178,7 @@ def generate_stream_response(messages, temperature, top_p, max_tokens, tools=Non
 
 
 @app.post("/v1/chat/completions")
-async def chat_completions(request: ChatRequest):
+async def chat_completions(request: ChatRequest, _: None = Depends(_verify_api_key)):
     try:
         if request.stream:
             return StreamingResponse(