Check for client secret before serving anything

api/src/app.py

@@ -1,11 +1,29 @@
 from __future__ import annotations
+from typing import Any
 
-from fastapi import FastAPI
+from fastapi import FastAPI, HTTPException, Request, Response
 
+from src import settings
 from src.deploy.routes import router as deploy_router
 
 app = FastAPI()
 
+
+AUTH_EXEMPT = ["/healthcheck"]
+
+
+@app.middleware("http")
+async def auth_check(request: Request, call_next: Any):
+    print(settings.CLIENT_SECRET, request.headers.get("X-Client-Secret"))
+    if (
+        request.url.path not in AUTH_EXEMPT
+        and settings.CLIENT_SECRET != request.headers.get("X-Client-Secret")
+    ):
+        return Response(status_code=403)
+
+    return await call_next(request)
+
+
 @app.get("/healthcheck")
 def healthcheck():
     return {"ok": True}

api/src/settings.py

@@ -15,3 +15,5 @@
 
 LAMBDA_ROLE_ARN = env.str("LAMBDA_ROLE_ARN")
 AWS_DEFAULT_REGION = env.str("AWS_DEFAULT_REGION", "us-east-1")
+
+CLIENT_SECRET = env.str("CLIENT_SECRET")