qing
e7a2877422
Replace the insecure local base64 decode (with FIXME comment about missing signature verification) with proper remote RSA signature verification through gateway's /whoami endpoint: - Add [gateway] config section (url, timeout) to dnfs.ini with defaults. - Support GATEWAY_URL environment variable override for Docker. - decode_token() now POSTs to gateway /whoami with Authorization: Bearer <token>; gateway verifies RSA signature and expiry, returns login/user/ is_admin. Network/gateway errors fail-closed with 503. - Add @_handle_exp decorators to delete_note() and update_note() which were missing exception handling wrappers (consistent with other routes). - docker-compose.yml: add GATEWAY_URL, CONFS_HOST, CONFS_PORT env vars plus host.docker.internal extra_hosts so dnfs container can reach host-side gateway and confs services.
17 lines
211 B
INI
17 lines
211 B
INI
[server]
|
|
host = 127.0.0.1
|
|
port = 8006
|
|
|
|
[database]
|
|
host = 127.0.0.1
|
|
port = 8005
|
|
timeout = 10
|
|
|
|
[ai_review]
|
|
url = http://127.0.0.1:8007/review
|
|
timeout = 10
|
|
|
|
[gateway]
|
|
url = http://127.0.0.1:8443/whoami
|
|
timeout = 5
|