mirror of
https://github.com/HKUDS/nanobot.git
synced 2026-08-05 08:58:34 +00:00
56443ac6e2
feat(api): require api_key when binding to all interfaces (parity with WS gateway) The OpenAI-compatible API server had no authentication option, unlike the WebSocket gateway which already refuses wildcard binds without a token. When bound to 0.0.0.0, any caller who could reach the port could drive the agent with its default tool posture. - Add api_key field to ApiConfig (schema.py). - Add wildcard_host_requires_auth validator that rejects wildcard binds without api_key, mirroring the WS gateway pattern. - Add Bearer-token auth middleware to the API server (server.py). /health remains unauthenticated. - Replace the wildcard-host CLI warning with a hard error when api_key is unset, and pass api_key to create_app. Fixes #4490 @