jpmschweitzerandClaude Fable 5
c5f90cdb4f
The wikijs-integration.js embedded a full-privilege API key that was served to every wiki visitor — it unlocked all 66 authenticated endpoints, including page/vector deletes and index purges. That key has been rotated out of service. The two browser endpoints (/ingest/page, /entity-linking/link-page) now authenticate via the NPM /library-desk/ proxy location instead of a key: Authentik forward-auth for external users, LAN bypass for internal, verified by a trusted proxy marker header. This is safe because library-desk binds loopback-only, so NPM is the sole path that can set that header. The browser holds no secret; the script calls same-origin with credentials. Machine callers (the Scheduler) keep the Bearer key on the container-network endpoints. verify_api_key now compares in constant time. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
32 lines
956 B
TOML
32 lines
956 B
TOML
[project]
|
|
name = "library-desk"
|
|
version = "1.9.0"
|
|
description = "Coordination service for The Library system - HybridRAG queries, document ingestion, entity extraction, and knowledge consolidation"
|
|
readme = "README.md"
|
|
requires-python = ">=3.12"
|
|
license = {text = "MIT"}
|
|
authors = [
|
|
{name = "JP Schweitzer"}
|
|
]
|
|
keywords = ["rag", "knowledge-graph", "wiki", "semantic-search", "neo4j", "qdrant"]
|
|
classifiers = [
|
|
"Development Status :: 4 - Beta",
|
|
"Framework :: FastAPI",
|
|
"Intended Audience :: Developers",
|
|
"License :: OSI Approved :: MIT License",
|
|
"Programming Language :: Python :: 3",
|
|
"Programming Language :: Python :: 3.12",
|
|
]
|
|
|
|
[project.urls]
|
|
Homepage = "https://github.com/jpmschweitzer/library-desk"
|
|
Documentation = "https://github.com/jpmschweitzer/library-desk#readme"
|
|
|
|
[build-system]
|
|
requires = ["setuptools>=61.0"]
|
|
build-backend = "setuptools.build_meta"
|
|
|
|
[tool.setuptools.packages.find]
|
|
where = ["."]
|
|
include = ["src*"]
|