fix: protect endpoints with auth API key

[franciscovelez]

I've just noticed that some endpoints in this project are not protected, so any person with the URL can make calls to /chat/completions, for instance, without knowing the API key. I've created a new FastAPI dependency function that check if a valid API key has been provided (get_current_user_or_abort) and added it to each endpoint.

[Marenz]

LGTM. Do we know if the calling side is also always using the KEY when it should?

[tjbck]

Should keep the get_current_user convention. Please refer to our main Open WebUI repo!

[franciscovelez]

Hi Timothy, I'm sorry but I don't understand what you mean. Are you talking about adding the HTTP exception in the get_current_user or implement something like the function get_current_user_by_api_key (https://github.com/open-webui/open-webui/blob/eff736acd2e0bbbdd0eeca4cc209b216a1f23b6a/backend/utils/utils.py#L116C5-L116C32)?

[jabbasj]

@franciscovelez The following quick change basically ensured that API key is validated for the completion endpoint:

@app.post("/v1/chat/completions")
@app.post("/chat/completions")
async def generate_openai_chat_completion(form_data: OpenAIChatCompletionForm, user: str = Depends(get_current_user)):

    if user != API_KEY:
        raise HTTPException(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Invalid API key",
            )

This doesn't meet your need?

[franciscovelez]

@jabbasj Of course this quick change solves the problem for that endpoint but I still think that we can take advantage of the injection system provided by FastAPI, create a function that performs those checks and reuse it (Don't Repeat Yourself principle).