mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-08-29 04:26:20 +00:00
Mohd KaifandZohaib Hassnain
3496d62335
* security: require API-key auth on all Explorer API routes (GHSA-j4mq-hprp-987v) Every Explorer route (bulk import/export, delete, LLM-backed ontology generation, SPARQL, etc.) was mounted with no authentication, and both server entrypoints bind 0.0.0.0 by default. Anyone reaching the port got full read/write/delete on the graph. - Add require_auth dependency (explorer/dependencies.py): checks X-API-Key against SEMANTICA_API_KEY, fails closed with 503 if unconfigured (not silently anonymous), 401 on wrong/missing key. SEMANTICA_ALLOW_ANONYMOUS=true opts out explicitly for local dev. - Wire dependencies=[Depends(require_auth)] into all 11 API routers in both explorer/app.py and server.py. /health, /api/info, static assets, and the SPA catch-all stay public. - /ws/graph-updates handshake now checks the same key via header or ?api_key= query param (browsers can't set custom WS headers) before accepting the connection. - Default bind changed from 0.0.0.0 to 127.0.0.1 in server.py's main() and cli.py's `server start`; the CLI warns if a non-loopback host is passed explicitly without a key configured. - Startup logging reports the resolved auth mode in both app factories. - Document/generate SEMANTICA_API_KEY in the deploy recipes that expose a public endpoint by default: docker-compose, Railway, Fly, Render. Added tests/explorer/test_explorer_auth.py covering fail-closed default, wrong/missing/correct key, anonymous opt-in, public-route exemptions, and the WS handshake. Added tests/explorer/conftest.py defaulting the pre-existing ~200 explorer tests to SEMANTICA_ALLOW_ANONYMOUS=true so they keep exercising route logic without needing a key. * fix CORS --------- Co-authored-by: Zohaib Hassnain <109234410+ZohaibHassan16@users.noreply.github.com>
Railway
Deploys the Knowledge Explorer from the root Dockerfile and checks /api/health.
railway login
railway init
railway add --database redis
railway variable --set "FALKORDB_HOST=${{Redis.REDISHOST}}"
railway variable --set "FALKORDB_PORT=${{Redis.REDISPORT}}"
railway variable --set "ALLOWED_ORIGINS=https://${{RAILWAY_PUBLIC_DOMAIN}}"
railway variable --set "SEMANTICA_API_KEY=$(openssl rand -hex 32)"
railway up
The Redis plugin variables are wired to the requested FalkorDB env names for deployment compatibility. The Explorer currently reads these settings but does not persist graph state to FalkorDB.
Railway exposes this service on a public domain, so SEMANTICA_API_KEY is required — without it the Explorer refuses every protected route (503) rather than serving anonymously. Pass the same value as the X-API-Key header from any client that talks to the deployed API.