add middleware

bases/bot_detector/api_public/src/core/fastapi/middleware/__init__.py

@@ -1,4 +1,5 @@
 from .logging import LoggingMiddleware
 from .metrics import PrometheusMiddleware
+from .security import SecurityMiddleware
 
-__all__ = ["LoggingMiddleware", "PrometheusMiddleware"]
+__all__ = ["LoggingMiddleware", "PrometheusMiddleware", "SecurityMiddleware"]

bases/bot_detector/api_public/src/core/fastapi/middleware/security.py

@@ -0,0 +1,22 @@
+import re
+
+from bot_detector.api_public.src.core.fastapi.dependencies import wide_event
+from fastapi import HTTPException, Request
+from starlette.middleware.base import BaseHTTPMiddleware
+
+UA_PATTERN = r"^RuneLite/\d+\.\d+\.\d+.*"
+ua_re = re.compile(UA_PATTERN)
+
+
+class SecurityMiddleware(BaseHTTPMiddleware):
+    async def dispatch(self, request: Request, call_next):
+        ua = request.headers.get("user-agent", "")
+        path = request.url.path
+
+        # only enforce on report endpoint
+        if path == "/v2/report":
+            if not ua_re.match(ua):
+                wide_event.add_context({"security": "Invalid UserAgent"})
+                raise HTTPException(status_code=403, detail="Forbidden")
+
+        return await call_next(request)

bases/bot_detector/api_public/src/core/server.py

@@ -5,6 +5,7 @@
 from bot_detector.api_public.src.core.fastapi.middleware import (
     LoggingMiddleware,
     PrometheusMiddleware,
+    SecurityMiddleware,
 )
 from bot_detector.event_queue.adapters.kafka import (
     KafkaConfig,
@@ -27,22 +28,25 @@ def init_routers(_app: FastAPI) -> None:
 
 
 def make_middleware() -> list[Middleware]:
+    cors_config = {
+        "allow_origins": [
+            "http://osrsbotdetector.com",
+            "https://osrsbotdetector.com",
+            "http://localhost",
+            "http://localhost:8080",
+        ],
+        "allow_credentials": True,
+        "allow_methods": ["*"],
+        "allow_headers": ["*"],
+    }
+
     middleware = [
-        Middleware(
-            CORSMiddleware,
-            allow_origins=[
-                "http://osrsbotdetector.com",
-                "https://osrsbotdetector.com",
-                "http://localhost",
-                "http://localhost:8080",
-            ],
-            allow_credentials=True,
-            allow_methods=["*"],
-            allow_headers=["*"],
-        ),
+        Middleware(SecurityMiddleware),
+        Middleware(CORSMiddleware, **cors_config),
         Middleware(LoggingMiddleware),
         Middleware(PrometheusMiddleware),
     ]
+
     return middleware