API key come hash SHA-256, una per sessione, TTL rinnovabile (#41)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-10-06 11:31:29 +02:00
parent 1d93eded27
commit 35f46926a9
14 changed files with 343 additions and 110 deletions
@@ -38,6 +38,9 @@ class Settings(BaseSettings):
    # configured limits to keep the cluster-wide effective limit close to what
    # was configured instead of multiplying it by N.
    web_concurrency: int = 1
+
+    # API key session lifetime (hours); renewed on use (env API_KEY_TTL_HOURS).
+    api_key_ttl_hours: int = 24
    # How many reverse proxies between the client and this API are trusted to
    # have appended their own hop to X-Forwarded-For (Nginx, in the default
    # deploy). Used by RateLimitMiddleware._client_ip. 0 disables proxy header