wrap all internal api calls with auth check and use token when possible

Signed-off-by: Vladimir Mandic <mandic00@live.com>

modules/api/api.py

@@ -117,8 +117,8 @@ class Api:
         from modules.civitai import api_civitai
         api_civitai.register_api()
 
-    def add_api_route(self, path: str, fn, **kwargs):
-        if self.credentials:
+    def add_api_route(self, path: str, fn, auth: bool = True, **kwargs):
+        if auth and self.credentials:
             deps = list(kwargs.get('dependencies', []))
             deps.append(Depends(self.auth))
             kwargs['dependencies'] = deps
@@ -132,6 +132,9 @@ class Api:
         if credentials.username in self.credentials:
             if compare_digest(credentials.password, self.credentials[credentials.username]):
                 return True
+            if hasattr(self.app, 'tokens') and (self.app.tokens is not None):
+                if credentials.password in self.app.tokens.keys():
+                    return True
         shared.log.error(f'API authentication: user="{credentials.username}" password="{credentials.password}"')
         raise HTTPException(status_code=401, detail="Unauthorized", headers={"WWW-Authenticate": "Basic"})
 

modules/api/middleware.py

@@ -81,7 +81,8 @@ def setup_middleware(app: FastAPI, cmd_opts):
         if err['code'] == 404 and 'file=html/' in req.url.path: # dont spam with locales
             return JSONResponse(status_code=err['code'], content=jsonable_encoder(err))
 
-        log.error(f"API error: {req.method}: {req.url} {err}")
+        if not any([req.url.path.endswith(x) for x in ignore_endpoints]): # noqa C419 # pylint: disable=use-a-generator
+            log.error(f"API error: {req.method}: {req.url} {err}")
 
         if not isinstance(e, HTTPException) and err['error'] != 'TypeError': # do not print backtrace on known httpexceptions
             errors.display(e, 'HTTP API', [anyio, fastapi, uvicorn, starlette])