mstar.api_server.auth

mstar.api_server.auth#

Optional API key for the HTTP and WebSocket surface.

Off unless --api-key or MSTAR_API_KEY sets a key. When set, every request except the probe and scrape paths in UNAUTHENTICATED_PATHS must carry Authorization: Bearer <key> (what the OpenAI SDKs send for api_key); WebSocket routes are checked at the handshake. The check is one ASGI middleware over the whole app rather than a per-route dependency, so a route added later is covered without anyone remembering to opt it in.

Module Attributes

UNAUTHENTICATED_PATHS

liveness probes from load balancers and orchestrators, and the Prometheus scrape endpoint (request counts, latencies and the model name; never prompts or outputs).

Functions

keep_api_key_from_children(api_key)

Only the HTTP frontend needs the key.

resolve_api_key([flag])

The deployment's key: --api-key if given, else MSTAR_API_KEY.

warn_if_no_api_key(api_key, host, port)

Classes

APIKeyGuard([key])

Holds the key (if any) and checks a request's headers against it.

APIKeyMiddleware(app, guard)

Pure ASGI (not BaseHTTPMiddleware), so it sees WebSocket scopes and never buffers a streamed response.
class mstar.api_server.auth.APIKeyGuard(key=None)[source]#

Bases: object

Holds the key (if any) and checks a request’s headers against it.

Mutable so the module-level app can install the middleware at import and the CLI can set the key once its flags are parsed.

Parameters:

key (str | None)

accepts(headers)[source]#
Parameters:

headers (list[tuple[bytes, bytes]])

Return type:

bool

property enabled: bool#
set(key)[source]#
Parameters:

key (str | None)

Return type:

None

class mstar.api_server.auth.APIKeyMiddleware(app, guard)[source]#

Bases: object

Pure ASGI (not BaseHTTPMiddleware), so it sees WebSocket scopes and never buffers a streamed response.

Parameters:

guard (APIKeyGuard)

mstar.api_server.auth.UNAUTHENTICATED_PATHS = frozenset({'/health', '/metrics'})#

liveness probes from load balancers and orchestrators, and the Prometheus scrape endpoint (request counts, latencies and the model name; never prompts or outputs).

Type:

Served without a key

mstar.api_server.auth.keep_api_key_from_children(api_key)[source]#

Only the HTTP frontend needs the key. Drop it from the environment and sys.argv (the spawn start method copies both into each child) before this process spawns the conductor, workers or media subprocesses.

Parameters:

api_key (str | None)

Return type:

None

mstar.api_server.auth.resolve_api_key(flag=None)[source]#

The deployment’s key: --api-key if given, else MSTAR_API_KEY. An empty value means no key.

Parameters:

flag (str | None)

Return type:

str | None

mstar.api_server.auth.warn_if_no_api_key(api_key, host, port)[source]#
Parameters:
Return type:

None