codegraphcontext 0.5.2__py3-none-any.whl → 0.5.4__py3-none-any.whl

codegraphcontext/api/app.py

@@ -1,12 +1,17 @@
 # src/codegraphcontext/api/app.py
 import os
-from fastapi import FastAPI
+from fastapi import Depends, FastAPI
 from fastapi.responses import HTMLResponse
 from fastapi.middleware.cors import CORSMiddleware
 from .router import router
+from .auth import log_auth_status, require_api_key
 from .mcp_sse import handle_sse, handle_messages
 
 def create_app() -> FastAPI:
+    # Log whether API-key auth is active. Emits a prominent security warning
+    # when the gateway is running unauthenticated (CGC_API_KEY unset).
+    log_auth_status()
+
     app = FastAPI(
         title="CodeGraphContext Gateway",
         description="HTTP API gateway for CodeGraphContext MCP server. Enables integration with ChatGPT Actions, Claude, and web frontends.",
@@ -32,9 +37,23 @@ def create_app() -> FastAPI:
         """Liveness probe for load balancers and k8s."""
         return {"status": "ok"}
 
-    # MCP-over-SSE Endpoints
-    app.add_api_route("/api/v1/mcp/sse", handle_sse, methods=["GET"])
-    app.add_api_route("/api/v1/mcp/messages", handle_messages, methods=["POST"])
+    # MCP-over-SSE Endpoints. These dispatch to the same tools as the REST
+    # router (execute_cypher_query, add_code_to_graph, delete_repository), so
+    # they need the same API-key dependency the router applies — without it,
+    # setting CGC_API_KEY left the SSE transport as an unauthenticated path to
+    # every tool.
+    app.add_api_route(
+        "/api/v1/mcp/sse",
+        handle_sse,
+        methods=["GET"],
+        dependencies=[Depends(require_api_key)],
+    )
+    app.add_api_route(
+        "/api/v1/mcp/messages",
+        handle_messages,
+        methods=["POST"],
+        dependencies=[Depends(require_api_key)],
+    )
 
     @app.get("/", response_class=HTMLResponse)
     async def root():
@@ -61,7 +80,7 @@ def create_app() -> FastAPI:
                     <a href="/docs" class="btn">View API Docs</a>
                     <div class="links">
                         <a href="/openapi.json">OpenAPI Spec</a>
-                        <a href="https://github.com/Shashankss1205/CodeGraphContext" target="_blank">GitHub</a>
+                        <a href="https://github.com/CodeGraphContext/CodeGraphContext" target="_blank">GitHub</a>
                     </div>
                 </div>
             </body>

codegraphcontext/api/auth.py

@@ -0,0 +1,123 @@
+# src/codegraphcontext/api/auth.py
+"""Optional API-key authentication for the CodeGraphContext HTTP API.
+
+Backward-compatible and opt-in:
+
+* When **no** key is configured, the API behaves exactly as it did before
+  (every endpoint is unauthenticated) but a prominent security warning is
+  logged at startup so operators know the gateway is wide open.
+* When a key **is** configured (via the ``CGC_API_KEY`` environment variable
+  or the standard config mechanism), every protected router endpoint requires
+  it, supplied as either ``Authorization: Bearer <key>`` or ``X-API-Key: <key>``.
+  Missing/incorrect keys receive an HTTP ``401``.
+
+The comparison uses :func:`secrets.compare_digest` to avoid timing side
+channels.
+"""
+
+import logging
+import os
+import secrets
+from typing import Optional
+
+from fastapi import Header, HTTPException
+
+logger = logging.getLogger(__name__)
+
+# Config/env key that holds the API key. Reused as the config_manager key so
+# ``cgc config set CGC_API_KEY <value>`` works as well.
+API_KEY_ENV = "CGC_API_KEY"
+
+
+def get_configured_api_key() -> Optional[str]:
+    """Return the configured API key, or ``None`` when auth is disabled.
+
+    Resolution order (highest priority first):
+
+    1. The ``CGC_API_KEY`` environment variable (read directly so auth works
+       even when no config file is present).
+    2. The value stored via the existing config mechanism
+       (:func:`codegraphcontext.cli.config_manager.get_config_value`).
+
+    Empty / whitespace-only values are treated as "not configured".
+    """
+    env_val = os.getenv(API_KEY_ENV)
+    if env_val and env_val.strip():
+        return env_val.strip()
+
+    # Fall back to the existing config mechanism (global/local .env, defaults).
+    try:
+        from codegraphcontext.cli.config_manager import get_config_value
+
+        cfg_val = get_config_value(API_KEY_ENV)
+        if cfg_val and cfg_val.strip():
+            return cfg_val.strip()
+    except Exception:  # pragma: no cover - config lookup is best-effort here
+        pass
+
+    return None
+
+
+def _extract_provided_key(
+    authorization: Optional[str], x_api_key: Optional[str]
+) -> Optional[str]:
+    """Pull the caller-supplied key from the Authorization or X-API-Key header."""
+    if authorization:
+        value = authorization.strip()
+        if value.lower().startswith("bearer "):
+            return value[len("bearer ") :].strip()
+        # Accept a bare token in the Authorization header as a convenience.
+        return value or None
+    if x_api_key and x_api_key.strip():
+        return x_api_key.strip()
+    return None
+
+
+def _keys_match(provided: str, configured: str) -> bool:
+    """Constant-time comparison that never raises on non-ASCII input."""
+    try:
+        return secrets.compare_digest(
+            provided.encode("utf-8"), configured.encode("utf-8")
+        )
+    except (TypeError, AttributeError):
+        return False
+
+
+async def require_api_key(
+    authorization: Optional[str] = Header(default=None),
+    x_api_key: Optional[str] = Header(default=None, alias="X-API-Key"),
+) -> None:
+    """FastAPI dependency that enforces the API key when one is configured.
+
+    No-op (backward compatible) when no key is set; otherwise requires a valid
+    key via ``Authorization: Bearer <key>`` or ``X-API-Key: <key>``, returning
+    HTTP ``401`` on a missing or incorrect key.
+    """
+    configured = get_configured_api_key()
+    if not configured:
+        # Auth disabled -> preserve the pre-existing unauthenticated behavior.
+        return
+
+    provided = _extract_provided_key(authorization, x_api_key)
+    if not provided or not _keys_match(provided, configured):
+        raise HTTPException(
+            status_code=401,
+            detail="Invalid or missing API key",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+
+def log_auth_status() -> None:
+    """Log the authentication status at app startup.
+
+    Emits a prominent WARNING when the API is unauthenticated so the insecure
+    default is impossible to miss in logs.
+    """
+    if get_configured_api_key():
+        logger.info("API key authentication is ENABLED (CGC_API_KEY is set).")
+    else:
+        logger.warning(
+            "⚠️  CodeGraphContext API is running WITHOUT authentication. "
+            "Anyone who can reach this server can index code, run Cypher queries "
+            "and call tools. Set CGC_API_KEY to require a key."
+        )

codegraphcontext/api/mcp_sse.py

@@ -48,11 +48,41 @@ async def handle_call_tool(name: str, arguments: dict | None) -> list[TextConten
 # Create the SSE transport.
 sse = SseServerTransport("/api/v1/mcp/messages")
 
+
+class _AlreadySentResponse(Response):
+    """Placeholder for a response the MCP transport wrote itself.
+
+    Both handlers below hand the raw ASGI ``send`` to the SDK, which emits the
+    complete response. FastAPI still does ``await endpoint(request)`` followed
+    by ``await response(...)``, so returning ``None`` raises ``TypeError:
+    'NoneType' object is not callable`` and returning a real ``Response`` starts
+    a second response on a finished ASGI cycle. This satisfies FastAPI while
+    putting nothing on the wire.
+    """
+
+    async def __call__(self, scope, receive, send) -> None:
+        return
+
+
+class _SendTracker:
+    """ASGI ``send`` wrapper that records whether a response was started."""
+
+    def __init__(self, send):
+        self._send = send
+        self.response_started = False
+
+    async def __call__(self, message) -> None:
+        if message.get("type") == "http.response.start":
+            self.response_started = True
+        await self._send(message)
+
+
 async def handle_sse(request: Request):
     """Entry point for the SSE connection."""
     logger.info("SSE client connected")
+    sender = _SendTracker(request._send)
     try:
-        async with sse.connect_sse(request.scope, request.receive, request._send) as (read_stream, write_stream):
+        async with sse.connect_sse(request.scope, request.receive, sender) as (read_stream, write_stream):
             await mcp_server.run(
                 read_stream,
                 write_stream,
@@ -70,6 +100,10 @@ async def handle_sse(request: Request):
         logger.debug("SSE connection closed: %s", type(exc).__name__)
     finally:
         logger.info("SSE client disconnected — handler exited, resources freed")
+    if sender.response_started:
+        return _AlreadySentResponse()
+    # connect_sse bailed out before writing anything (e.g. rejected origin).
+    return Response(status_code=500, content="SSE connection could not be established")
 
 
 async def handle_messages(request: Request):
@@ -99,7 +133,20 @@ async def handle_messages(request: Request):
             media_type="application/json"
         )
 
+    # `handle_post_message` builds its own Request and awaits `.body()` again.
+    # Starlette caches a body on the Request instance, not in the scope, so
+    # handing it the raw `receive` would make it wait for a body that has
+    # already been drained above — the POST hangs until the client gives up and
+    # the message never reaches the session. Replay the buffered bytes instead.
+    async def replay_receive() -> dict:
+        return {"type": "http.request", "body": raw_body, "more_body": False}
+
+    sender = _SendTracker(request._send)
     try:
-        await sse.handle_post_message(request.scope, request.receive, request._send)
+        await sse.handle_post_message(request.scope, replay_receive, sender)
     except Exception as exc:
         logger.debug("Message handler closed: %s", type(exc).__name__)
+
+    if sender.response_started:
+        return _AlreadySentResponse()
+    return Response(status_code=202, content="Accepted")

codegraphcontext/api/router.py

@@ -5,17 +5,21 @@ from typing import Dict, Any, List
 from pathlib import Path
 
 from .schemas import (
-    IndexRequest, 
-    QueryRequest, 
-    SearchRequest, 
-    ToolCallRequest, 
+    IndexRequest,
+    QueryRequest,
+    SearchRequest,
+    ToolCallRequest,
     ApiResponse
 )
+from .auth import require_api_key
 from codegraphcontext.server import MCPServer
 
 import socket
 
-router = APIRouter()
+# Optional API-key auth is enforced on every route below via require_api_key.
+# It is a no-op (backward compatible) unless CGC_API_KEY is configured, in
+# which case each request must supply the key. See codegraphcontext.api.auth.
+router = APIRouter(dependencies=[Depends(require_api_key)])
 
 # Global server instance (initialized on startup)
 _server_instance: MCPServer = None