amfs-http-server 0.3.2__tar.gz → 0.3.3__tar.gz

{amfs_http_server-0.3.2 → amfs_http_server-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: amfs-http-server
-Version: 0.3.2
+Version: 0.3.3
 Summary: AMFS HTTP/REST API server with SSE support
 License-Expression: Apache-2.0
 Requires-Python: >=3.11

{amfs_http_server-0.3.2 → amfs_http_server-0.3.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "amfs-http-server"
-version = "0.3.2"
+version = "0.3.3"
 description = "AMFS HTTP/REST API server with SSE support"
 requires-python = ">=3.11"
 license = "Apache-2.0"

{amfs_http_server-0.3.2 → amfs_http_server-0.3.3}/src/amfs_http/auth.py

@@ -5,6 +5,8 @@ import hashlib
 import logging
 import os
 import secrets
+import threading
+import time
 
 from fastapi import HTTPException, Security, status
 from fastapi.security import APIKeyHeader
@@ -13,6 +15,10 @@ logger = logging.getLogger(__name__)
 
 API_KEY_HEADER = APIKeyHeader(name="X-AMFS-API-Key", auto_error=False)
 
+_AUTH_CACHE_TTL = 120.0
+_auth_cache: dict[str, float] = {}
+_auth_cache_lock = threading.Lock()
+
 
 def get_api_keys() -> set[str]:
     raw = os.environ.get("AMFS_API_KEYS", "")
@@ -25,12 +31,22 @@ def _check_db_key(api_key: str) -> bool:
     """Check if an API key exists in amfs_api_keys table (active keys only).
 
     Keys are stored as SHA-256 hex digests, so we hash the incoming raw key
-    before comparing.
+    before comparing.  Results are cached in-process for ``_AUTH_CACHE_TTL``
+    seconds to avoid opening a new DB connection on every request.  Only
+    positive results are cached; revoked/invalid keys always hit the DB.
 
     Uses SECURITY DEFINER functions to bypass RLS — this connection does not
     set amfs.current_account_id, so direct table queries would return nothing
     when FORCE ROW LEVEL SECURITY is enabled.
     """
+    key_hash = hashlib.sha256(api_key.encode()).hexdigest()
+    now = time.monotonic()
+
+    with _auth_cache_lock:
+        cached_at = _auth_cache.get(key_hash)
+        if cached_at is not None and (now - cached_at) < _AUTH_CACHE_TTL:
+            return True
+
     try:
         import psycopg
         from psycopg.rows import dict_row
@@ -39,8 +55,6 @@ def _check_db_key(api_key: str) -> bool:
         if not dsn:
             return False
 
-        key_hash = hashlib.sha256(api_key.encode()).hexdigest()
-
         with psycopg.connect(dsn, row_factory=dict_row) as conn:
             row = conn.execute(
                 "SELECT * FROM amfs_authenticate_api_key(%s)",
@@ -51,7 +65,11 @@ def _check_db_key(api_key: str) -> bool:
                     "SELECT amfs_touch_api_key_usage(%s)",
                     (row["key_id"],),
                 )
-            return row is not None
+            if row is not None:
+                with _auth_cache_lock:
+                    _auth_cache[key_hash] = now
+                return True
+            return False
     except Exception:
         logger.debug("DB API key check failed (table may not exist)", exc_info=True)
         return False