kenzuya/unshackle
1
0
Fork 2
mirror of https://github.com/unshackle-dl/unshackle.git synced 2026-11-14 13:05:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(api)!: key the health route and keep server internals from user keys

Browse Source 
/api/health needs X-Secret-Key but stays outside the rate limit. Only the admin key gets load_errors from /api/services, default error details no longer name the exception class, and a prepare signal replaces aiohttp's Server banner on every response while the CDM routes keep their own.
This commit is contained in:
imSp4rky
2026-11-03 11:53:55 -07:00
parent b6429ecdfd
commit 87ccd6666c
16 changed files with 105 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/dev/rest-api/index.md
+5 -5
View File
@@ -126,12 +126,12 @@ health check is `GET http://127.0.0.1:8786/api/health`.
available at [`/api/docs/`](http://127.0.0.1:8786/api/docs/). The server generates
it from the same route table it serves, so it always matches the version you
operate. Note that in `--api-only` mode the docs page is itself behind the
API key. Only `/api/health` is exempt from authentication.
API key, like every other route.
A quick smoke test that needs no API key:
A quick smoke test:
```shell title="Confirm the server is up"
curl http://127.0.0.1:8786/api/health
curl -H "X-Secret-Key: your-api-secret" http://127.0.0.1:8786/api/health
```
```json title="Response"
@@ -156,7 +156,7 @@ request and response in full.
| Method | Path | Purpose |
|---|---|---|
| `GET` | `/api/health` | Liveness and version check. Never requires an API key. |
| `GET` | `/api/health` | Liveness and version check. |
| `GET` | `/api/services` | List the services available on this server. |
| `POST` | `/api/search` | Run a service's search for a query. |
| `POST` | `/api/list-titles` | List the titles behind a service title ID. |
@@ -220,7 +220,7 @@ request and response in full.
## Authentication in one line
With the default configuration, send your API secret in the `X-Secret-Key` header on
every request except `/api/health`:
every request:
```shell title="An authenticated request"
curl -X POST http://127.0.0.1:8786/api/search \