mirror of
https://github.com/mudler/LocalAI.git
synced 2026-10-28 09:08:54 -04:00
Richard Palethorpe
3de91d48d9
Add the GEM-X native backend with live pose and root displacement output, bounded duplex WebSocket streaming, session authorization, metrics and usage accounting. Share the embedded bidirectional RPC channel adapter across streaming backends.
Include backend build and gallery integration, API documentation, schemas and tests.
Assisted-by: Codex:gpt-6
Signed-off-by: Richard Palethorpe <io@richiejp.com>
(cherry picked from commit 016dc3d71a)
37 lines
1.3 KiB
Go
37 lines
1.3 KiB
Go
// SPDX-License-Identifier: MIT
|
|
|
|
package auth
|
|
|
|
import (
|
|
"github.com/labstack/echo/v4"
|
|
"github.com/labstack/echo/v4/middleware"
|
|
)
|
|
|
|
// CSRFMiddleware must run after Middleware so only validated header credentials
|
|
// grant an exemption. Cookie authentication must still pass the browser checks.
|
|
func CSRFMiddleware() echo.MiddlewareFunc {
|
|
return CSRFMiddlewareWithCORS(false)
|
|
}
|
|
|
|
// CSRFMiddlewareWithCORS also trusts origins approved by an explicitly configured CORS policy.
|
|
// CORS middleware must run before this middleware.
|
|
func CSRFMiddlewareWithCORS(explicitCORS bool) echo.MiddlewareFunc {
|
|
return middleware.CSRFWithConfig(middleware.CSRFConfig{
|
|
Skipper: func(c echo.Context) bool {
|
|
if authenticated, _ := c.Get(contextKeyHeaderAuthenticated).(bool); authenticated {
|
|
return true
|
|
}
|
|
// Preserve support for clients that do not send fetch metadata.
|
|
return c.Request().Header.Get("Sec-Fetch-Site") == ""
|
|
},
|
|
AllowSecFetchSiteFunc: func(c echo.Context) (bool, error) {
|
|
if c.Request().Header.Get("Sec-Fetch-Site") == "same-site" {
|
|
return true, nil
|
|
}
|
|
origin := c.Request().Header.Get(echo.HeaderOrigin)
|
|
allowed := c.Response().Header().Get(echo.HeaderAccessControlAllowOrigin)
|
|
return explicitCORS && origin != "" && (allowed == "*" || allowed == origin), nil
|
|
},
|
|
})
|
|
}
|