| 1 | # api.py DOX |
| 2 | |
| 3 | ## Purpose |
| 4 | |
| 5 | - Own the `api.py` helper module. |
| 6 | - This module defines API handler registration, request security gates, CSRF checks, and watchdog registration. |
| 7 | - Keep this file-level DOX profile synchronized with `api.py` because this directory is intentionally flat. |
| 8 | |
| 9 | ## Ownership |
| 10 | |
| 11 | - `api.py` owns the runtime implementation. |
| 12 | - `api.py.dox.md` owns durable notes about responsibilities, contracts, side effects, and verification for that implementation. |
| 13 | - Classes: |
| 14 | - `ApiHandler` (no explicit base class) |
| 15 | - `requires_loopback(cls) -> bool` |
| 16 | - `requires_api_key(cls) -> bool` |
| 17 | - `requires_auth(cls) -> bool` |
| 18 | - `get_methods(cls) -> list[str]` |
| 19 | - `requires_csrf(cls) -> bool` |
| 20 | - `async process(self, input: Input, request: Request) -> Output` |
| 21 | - `async handle_request(self, request: Request) -> Response` |
| 22 | - `use_context(self, ctxid: str, create_if_not_exists: bool=...)` |
| 23 | - Top-level functions: |
| 24 | - `requires_api_key(f)` |
| 25 | - `requires_loopback(f)` |
| 26 | - `requires_auth(f)` |
| 27 | - `csrf_protect(f)` |
| 28 | - `register_api_route(app: Flask, lock: ThreadLockType) -> None` |
| 29 | - `register_watchdogs()` |
| 30 | - Notable constants/configuration names: `CACHE_AREA`. |
| 31 | |
| 32 | ## Runtime Contracts |
| 33 | |
| 34 | - Helper modules own reusable framework APIs and must preserve public callers unless all callers, tests, and docs are updated together. |
| 35 | - Update this file whenever public functions, classes, persistence behavior, path/security assumptions, side effects, or cross-module contracts change. |
| 36 | - `ApiHandler` defines `process(...)`. |
| 37 | - `ApiHandler` defines `get_methods(...)`. |
| 38 | - `ApiHandler` defines `requires_auth(...)`. |
| 39 | - `ApiHandler` defines `requires_csrf(...)`. |
| 40 | - `ApiHandler` defines `requires_api_key(...)`. |
| 41 | - `ApiHandler` defines `requires_loopback(...)`. |
| 42 | - Observed side-effect areas: filesystem reads, filesystem writes, filesystem deletion, WebSocket state, plugin state, settings/state persistence, secret handling. |
| 43 | - Imported dependency areas include: `abc`, `flask`, `functools`, `helpers`, `helpers.errors`, `helpers.network`, `helpers.print_style`, `json`, `pathlib`, `threading`, `typing`, `werkzeug.wrappers.response`. |
| 44 | |
| 45 | ## Key Concepts |
| 46 | |
| 47 | - Important called helpers/classes observed in the source: `wraps`, `app.add_url_rule`, `watchdog.add_watchdog`, `cls.requires_auth`, `_use_context`, `login.get_credentials_hash`, `files.get_abs_path`, `handler_cls.requires_csrf`, `handler_cls.requires_api_key`, `handler_cls.requires_auth`, `handler_cls.requires_loopback`, `cache.add`, `PrintStyle.debug`, `cache.clear`, `get_settings`, `f`, `is_loopback_address`, `Response`, `redirect`, `files.is_in_dir`. |
| 48 | - HTTP handlers retain built-in `api/` and explicit plugin API precedence, then fall back to standalone `usr/api/`; built-in and user roots are containment-checked, and every loaded handler keeps its declared authentication, CSRF, API-key, loopback, and method gates. |
| 49 | - Keep request/response, tool, or helper semantics documented here at the same time as source changes. |
| 50 | |
| 51 | ## Work Guidance |
| 52 | |
| 53 | - Preserve public helper APIs used by core code and plugins unless every caller is updated. |
| 54 | - Keep path, auth, secret, persistence, network, and subprocess behavior explicit and bounded. |
| 55 | - Prefer adding cohesive helper functions here only when behavior is reused across modules. |
| 56 | |
| 57 | ## Verification |
| 58 | |
| 59 | - Run targeted tests for changed helper behavior; run security regressions for auth, filesystem, WebSocket, tunnel, upload, or secret-handling helpers. |
| 60 | - Related tests observed by source search: |
| 61 | - `tests/test_api_chat_lifetime.py` |
| 62 | - `tests/test_browser_agent_regressions.py` |
| 63 | - `tests/test_download_toast_regressions.py` |
| 64 | - `tests/test_fasta2a_client.py` |
| 65 | - `tests/test_fastmcp_openapi_security.py` |
| 66 | - `tests/test_host_browser_connector.py` |
| 67 | - `tests/test_image_get_security.py` |
| 68 | - `tests/test_model_config_api_keys.py` |
| 69 | |
| 70 | ## Child DOX Index |
| 71 | |
| 72 | No child DOX files. |