feat(api): add API key authentication to /todo endpoint

README.md

@@ -56,13 +56,9 @@ ASCII art text. Returns string.
 ## Development
 
 ```
-brew bundle
+uv sync --locked
 ```
 
 ```
 prek install
 ```
-
-```
-uv sync --locked
-```

pyproject.toml

@@ -16,6 +16,7 @@ tlacuilo = "tlacuilo.api.routes:main"
 
 [dependency-groups]
 dev = [
+  "prek>=0.3.8",
   "pytest>=9.0.2",
   "pytest-cov>=7.0.0",
   "ruff>=0.14.14",

src/tlacuilo/api/auth.py

@@ -0,0 +1,13 @@
+from fastapi import HTTPException, Security
+from fastapi.security import APIKeyHeader
+
+from tlacuilo.core import config
+
+API_KEY = config.API_KEY
+api_key_header = APIKeyHeader(name="X-API-Key")
+
+
+def verify_key(key: str = Security(api_key_header)):
+    if key != API_KEY:
+        raise HTTPException(status_code=403, detail="Invalid API Key")
+    return key

src/tlacuilo/api/routes.py

@@ -2,9 +2,10 @@
 import os
 
 import uvicorn
-from fastapi import FastAPI
+from fastapi import Depends, FastAPI
 from pydantic import BaseModel
 
+from tlacuilo.api.auth import verify_key
 from tlacuilo.core.config import BUILTIN_TEMPLATES_DIR, USER_TEMPLATES_DIR
 from tlacuilo.core.log_config import LOGGING_CONFIG
 from tlacuilo.printer.print import render_and_execute_template
@@ -20,7 +21,7 @@ class TodoRequest(BaseModel):
     todo: str
 
 
-@app.post("/todo")
+@app.post("/todo", dependencies=[Depends(verify_key)])
 def create_todo(req: TodoRequest):
     log.info("Todo Received")
     printer = get_printer()

src/tlacuilo/core/config.py

@@ -13,3 +13,5 @@
 
 USER_TEMPLATES_DIR = Path("templates")
 BUILTIN_TEMPLATES_DIR = Path("src/tlacuilo/templates/builtin")
+
+API_KEY = os.getenv("API_KEY")