mirror of
https://github.com/Significant-Gravitas/AutoGPT.git
synced 2026-04-08 03:00:28 -04:00
12cdd45551
Our current auth setup (`autogpt_libs.auth` + its usage) is quite inconsistent and doesn't do all of its jobs properly. The 401 responses you get when unauthenticated are not included in the OpenAPI spec, causing these to be unaccounted for in the generated frontend API client. Usage of the FastAPI dependencies supplied by `autogpt_libs.auth.depends` aren't consistently used the same way, making maintenance on these hard to oversee. API tests use many different ways to get around the auth requirement, making this also hard to maintain and oversee. This pull request aims to fix all of this and give us a consistent, clean, and self-documenting API auth implementation. - Resolves #10715 ### Changes 🏗️ - Homogenize use of `autogpt_libs.auth` security dependencies throughout the backend - Fix OpenAPI schema generation for 401 responses - Handle possible 401 responses in frontend - Tighten validation and add warnings for weak settings in `autogpt_libs.auth.config` - Increase test coverage for `autogpt_libs.auth` to 100% - Standardize auth setup for API tests - Rename `APIKeyValidator` to `APIKeyAuthenticator` and move to its own module in `backend.server` ### Checklist 📋 #### For code changes: - [x] I have clearly listed my changes in the PR description - [x] I have made a test plan - [x] I have tested my changes according to the test plan: - [x] All tests for `autogpt_libs.auth` pass - [x] All tests for `backend.server` pass - [x] @ntindle does a security audit for these changes - [x] OpenAPI spec for authenticated routes is generated with the appropriate `401` response --------- Co-authored-by: Nicholas Tindle <nicholas.tindle@agpt.co>
178 lines
5.6 KiB
Plaintext
178 lines
5.6 KiB
Plaintext
# Backend Configuration
|
|
# This file contains environment variables that MUST be set for the AutoGPT platform
|
|
# Variables with working defaults in settings.py are not included here
|
|
|
|
## ===== REQUIRED DATABASE CONFIGURATION ===== ##
|
|
# PostgreSQL Database Connection
|
|
DB_USER=postgres
|
|
DB_PASS=your-super-secret-and-long-postgres-password
|
|
DB_NAME=postgres
|
|
DB_PORT=5432
|
|
DB_HOST=localhost
|
|
DB_CONNECTION_LIMIT=12
|
|
DB_CONNECT_TIMEOUT=60
|
|
DB_POOL_TIMEOUT=300
|
|
DB_SCHEMA=platform
|
|
DATABASE_URL="postgresql://${DB_USER}:${DB_PASS}@${DB_HOST}:${DB_PORT}/${DB_NAME}?schema=${DB_SCHEMA}&connect_timeout=${DB_CONNECT_TIMEOUT}"
|
|
DIRECT_URL="postgresql://${DB_USER}:${DB_PASS}@${DB_HOST}:${DB_PORT}/${DB_NAME}?schema=${DB_SCHEMA}&connect_timeout=${DB_CONNECT_TIMEOUT}"
|
|
PRISMA_SCHEMA="postgres/schema.prisma"
|
|
|
|
## ===== REQUIRED SERVICE CREDENTIALS ===== ##
|
|
# Redis Configuration
|
|
REDIS_HOST=localhost
|
|
REDIS_PORT=6379
|
|
REDIS_PASSWORD=password
|
|
|
|
# RabbitMQ Credentials
|
|
RABBITMQ_DEFAULT_USER=rabbitmq_user_default
|
|
RABBITMQ_DEFAULT_PASS=k0VMxyIJF9S35f3x2uaw5IWAl6Y536O7
|
|
|
|
# Supabase Authentication
|
|
SUPABASE_URL=http://localhost:8000
|
|
SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJzZXJ2aWNlX3JvbGUiLAogICAgImlzcyI6ICJzdXBhYmFzZS1kZW1vIiwKICAgICJpYXQiOiAxNjQxNzY5MjAwLAogICAgImV4cCI6IDE3OTk1MzU2MDAKfQ.DaYlNEoUrrEn2Ig7tqibS-PHK5vgusbcbo7X36XVt4Q
|
|
JWT_VERIFY_KEY=your-super-secret-jwt-token-with-at-least-32-characters-long
|
|
|
|
## ===== REQUIRED SECURITY KEYS ===== ##
|
|
# Generate using: from cryptography.fernet import Fernet;Fernet.generate_key().decode()
|
|
ENCRYPTION_KEY=dvziYgz0KSK8FENhju0ZYi8-fRTfAdlz6YLhdB_jhNw=
|
|
UNSUBSCRIBE_SECRET_KEY=HlP8ivStJjmbf6NKi78m_3FnOogut0t5ckzjsIqeaio=
|
|
|
|
## ===== IMPORTANT OPTIONAL CONFIGURATION ===== ##
|
|
# Platform URLs (set these for webhooks and OAuth to work)
|
|
PLATFORM_BASE_URL=http://localhost:8000
|
|
FRONTEND_BASE_URL=http://localhost:3000
|
|
|
|
# Media Storage (required for marketplace and library functionality)
|
|
MEDIA_GCS_BUCKET_NAME=
|
|
|
|
## ===== API KEYS AND OAUTH CREDENTIALS ===== ##
|
|
# All API keys below are optional - only add what you need
|
|
|
|
# AI/LLM Services
|
|
OPENAI_API_KEY=
|
|
ANTHROPIC_API_KEY=
|
|
GROQ_API_KEY=
|
|
LLAMA_API_KEY=
|
|
AIML_API_KEY=
|
|
V0_API_KEY=
|
|
OPEN_ROUTER_API_KEY=
|
|
NVIDIA_API_KEY=
|
|
|
|
# OAuth Credentials
|
|
# For the OAuth callback URL, use <your_frontend_url>/auth/integrations/oauth_callback,
|
|
# e.g. http://localhost:3000/auth/integrations/oauth_callback
|
|
|
|
# GitHub OAuth App server credentials - https://github.com/settings/developers
|
|
GITHUB_CLIENT_ID=
|
|
GITHUB_CLIENT_SECRET=
|
|
|
|
# Google OAuth App server credentials - https://console.cloud.google.com/apis/credentials, and enable gmail api and set scopes
|
|
# https://console.cloud.google.com/apis/credentials/consent ?project=<your_project_id>
|
|
# You'll need to add/enable the following scopes (minimum):
|
|
# https://console.developers.google.com/apis/api/gmail.googleapis.com/overview ?project=<your_project_id>
|
|
# https://console.cloud.google.com/apis/library/sheets.googleapis.com/ ?project=<your_project_id>
|
|
GOOGLE_CLIENT_ID=
|
|
GOOGLE_CLIENT_SECRET=
|
|
|
|
# Twitter (X) OAuth 2.0 with PKCE Configuration
|
|
# 1. Create a Twitter Developer Account:
|
|
# - Visit https://developer.x.com/en and sign up
|
|
# 2. Set up your application:
|
|
# - Navigate to Developer Portal > Projects > Create Project
|
|
# - Add a new app to your project
|
|
# 3. Configure app settings:
|
|
# - App Permissions: Read + Write + Direct Messages
|
|
# - App Type: Web App, Automated App or Bot
|
|
# - OAuth 2.0 Callback URL: http://localhost:3000/auth/integrations/oauth_callback
|
|
# - Save your Client ID and Client Secret below
|
|
TWITTER_CLIENT_ID=
|
|
TWITTER_CLIENT_SECRET=
|
|
|
|
# Linear App
|
|
# Make a new workspace for your OAuth APP -- trust me
|
|
# https://linear.app/settings/api/applications/new
|
|
# Callback URL: http://localhost:3000/auth/integrations/oauth_callback
|
|
LINEAR_CLIENT_ID=
|
|
LINEAR_CLIENT_SECRET=
|
|
|
|
# To obtain Todoist API credentials:
|
|
# 1. Create a Todoist account at todoist.com
|
|
# 2. Visit the Developer Console: https://developer.todoist.com/appconsole.html
|
|
# 3. Click "Create new app"
|
|
# 4. Once created, copy your Client ID and Client Secret below
|
|
TODOIST_CLIENT_ID=
|
|
TODOIST_CLIENT_SECRET=
|
|
|
|
NOTION_CLIENT_ID=
|
|
NOTION_CLIENT_SECRET=
|
|
|
|
# Discord OAuth App credentials
|
|
# 1. Go to https://discord.com/developers/applications
|
|
# 2. Create a new application
|
|
# 3. Go to OAuth2 section and add redirect URI: http://localhost:3000/auth/integrations/oauth_callback
|
|
# 4. Copy Client ID and Client Secret below
|
|
DISCORD_CLIENT_ID=
|
|
DISCORD_CLIENT_SECRET=
|
|
|
|
REDDIT_CLIENT_ID=
|
|
REDDIT_CLIENT_SECRET=
|
|
|
|
# Payment Processing
|
|
STRIPE_API_KEY=
|
|
STRIPE_WEBHOOK_SECRET=
|
|
|
|
# Email Service (for sending notifications and confirmations)
|
|
POSTMARK_SERVER_API_TOKEN=
|
|
POSTMARK_SENDER_EMAIL=invalid@invalid.com
|
|
POSTMARK_WEBHOOK_TOKEN=
|
|
|
|
# Error Tracking
|
|
SENTRY_DSN=
|
|
|
|
# Cloudflare Turnstile (CAPTCHA) Configuration
|
|
# Get these from the Cloudflare Turnstile dashboard: https://dash.cloudflare.com/?to=/:account/turnstile
|
|
# This is the backend secret key
|
|
TURNSTILE_SECRET_KEY=
|
|
# This is the verify URL
|
|
TURNSTILE_VERIFY_URL=https://challenges.cloudflare.com/turnstile/v0/siteverify
|
|
|
|
# Feature Flags
|
|
LAUNCH_DARKLY_SDK_KEY=
|
|
|
|
# Content Generation & Media
|
|
DID_API_KEY=
|
|
FAL_API_KEY=
|
|
IDEOGRAM_API_KEY=
|
|
REPLICATE_API_KEY=
|
|
REVID_API_KEY=
|
|
SCREENSHOTONE_API_KEY=
|
|
UNREAL_SPEECH_API_KEY=
|
|
|
|
# Data & Search Services
|
|
E2B_API_KEY=
|
|
EXA_API_KEY=
|
|
JINA_API_KEY=
|
|
MEM0_API_KEY=
|
|
OPENWEATHERMAP_API_KEY=
|
|
GOOGLE_MAPS_API_KEY=
|
|
|
|
# Communication Services
|
|
DISCORD_BOT_TOKEN=
|
|
MEDIUM_API_KEY=
|
|
MEDIUM_AUTHOR_ID=
|
|
SMTP_SERVER=
|
|
SMTP_PORT=
|
|
SMTP_USERNAME=
|
|
SMTP_PASSWORD=
|
|
|
|
# Business & Marketing Tools
|
|
APOLLO_API_KEY=
|
|
ENRICHLAYER_API_KEY=
|
|
AYRSHARE_API_KEY=
|
|
AYRSHARE_JWT_KEY=
|
|
SMARTLEAD_API_KEY=
|
|
ZEROBOUNCE_API_KEY=
|
|
|
|
# Other Services
|
|
AUTOMOD_API_KEY=
|