"""TTS Voice Creator - Clone and Design — FastAPI entry point (thin wrapper).""" from __future__ import annotations import logging import os from logging.handlers import RotatingFileHandler from pathlib import Path from contextlib import asynccontextmanager from urllib.parse import parse_qs from fastapi import FastAPI from fastapi.staticfiles import StaticFiles from fastapi.middleware.gzip import GZipMiddleware from starlette.datastructures import MutableHeaders from core.constants import STATIC_DIR, _BufferHandler from core.config import _load_settings, _ensure_external_api_key from core.voice_index import refresh_voice_index_background from routes import admin, settings, library, stt, sources, docker, tts, conversation, reader, characters, rehearsals_db logger = logging.getLogger("uvicorn.error") # ── App ─────────────────────────────────────────────────────────────────────── @asynccontextmanager async def lifespan(app: FastAPI): # Uvicorn resets loggers during startup when run via CLI. # We must attach our handlers here to ensure they capture the active logs. for name in ("uvicorn", "uvicorn.error", "uvicorn.access", "fastapi"): l = logging.getLogger(name) if _buf_handler not in l.handlers: l.addHandler(_buf_handler) if "_file_handler" in globals() and _file_handler not in l.handlers: l.addHandler(_file_handler) try: refresh_voice_index_background(_load_settings()) except Exception as exc: logger.warning("Could not start voice index refresh: %s", exc) yield app = FastAPI(title="TTS Voice Creator - Clone and Design", lifespan=lifespan) # ── Response compression ────────────────────────────────────────────────────── # Gzip text assets (JS/CSS/HTML/JSON) above 1 KB — ~75% smaller transfer for the # large JS bundle and voice-list JSON. Skips already-compressed audio/images. app.add_middleware(GZipMiddleware, minimum_size=1024) # ── In-memory log buffer handler ────────────────────────────────────────────── _buf_handler = _BufferHandler() _buf_handler.setLevel(logging.DEBUG) logging.getLogger().addHandler(_buf_handler) # ── File log handler (rotates at 5 MB, keeps 3 files) ──────────────────────── _LOG_DIR = Path(os.environ.get("LOG_DIR", "/logs")) try: _LOG_DIR.mkdir(parents=True, exist_ok=True) _file_handler = RotatingFileHandler( _LOG_DIR / "app.log", maxBytes=5 * 1024 * 1024, backupCount=3, encoding="utf-8", ) _file_handler.setLevel(logging.INFO) _file_handler.setFormatter(logging.Formatter( "%(asctime)s %(levelname)-8s %(name)s: %(message)s", datefmt="%Y-%m-%d %H:%M:%S", )) logging.getLogger().addHandler(_file_handler) except Exception as _log_err: logger.warning("Could not set up file logging at %s: %s", _LOG_DIR, _log_err) # ── Static-asset caching middleware ────────────────────────────────────────── # JS and CSS are served with ?v= by loader.js — safe to cache for 1 year. # Section HTML uses ?v= (always fresh) so no long-term cache there. # # Pure ASGI middleware, not @app.middleware("http") (= Starlette's # BaseHTTPMiddleware) — that implementation wraps every request in a task # group around call_next(), and a client disconnecting mid-StreamingResponse # (e.g. the live-attribution SSE stream hitting its idle timeout) races that # task group and raises "RuntimeError: No response returned." This class # only touches response headers via the raw `send` callable, so it never # holds the response open the way call_next() does. class StaticCacheHeadersMiddleware: def __init__(self, app): self.app = app async def __call__(self, scope, receive, send): if scope["type"] != "http": await self.app(scope, receive, send) return path = scope["path"] has_version = "v" in parse_qs((scope.get("query_string") or b"").decode()) async def send_wrapper(message): if message["type"] == "http.response.start": headers = MutableHeaders(scope=message) if has_version and (path.startswith("/static/js/") or path.endswith(".css")): headers["Cache-Control"] = "public, max-age=31536000, immutable" elif path.startswith("/static/sections/"): headers["Cache-Control"] = "no-store" elif path.startswith("/static/vendor/"): headers["Cache-Control"] = "public, max-age=86400" elif path.startswith("/static/") and not has_version: # Bootstrap files (style.css, loader.js, nav.js, …) are loaded without a ?v= query. # Revalidate on every load so GUI edits appear after a normal reload — the server # returns 304 when the file is unchanged, so this stays cheap. headers["Cache-Control"] = "no-cache" await send(message) await self.app(scope, receive, send_wrapper) app.add_middleware(StaticCacheHeadersMiddleware) # ── API-key gate for non-browser callers ──────────────────────────────────── # The app's own UI calls /api/* same-origin from the browser and needs no # key — everything else (curl, scripts, MCP clients, agents) does. Gated by # Origin/Referer host matching the request's own Host header, which the # browser sets automatically and a bare script/curl call generally doesn't. # /mcp always requires the key regardless of origin, since no in-app browser # code calls it — it exists specifically for external MCP clients. # Raw ASGI (not @app.middleware("http")/BaseHTTPMiddleware) for the same # reason as StaticCacheHeadersMiddleware above: that wrapper's task-group # around call_next() fights with a client disconnecting mid-SSE-stream. class ApiKeyGateMiddleware: def __init__(self, app): self.app = app async def __call__(self, scope, receive, send): if scope["type"] != "http": await self.app(scope, receive, send) return path = scope["path"] if not (path.startswith("/api/") or path == "/mcp"): await self.app(scope, receive, send) return if not _load_settings().get("external_api_key_required"): # Off by default — see the settings-key comment in core/config.py # for why. /mcp still needs SOME signal it's being used # deliberately even while the general gate is off, but that's a # judgment call for whoever enables it, not a silent bypass. await self.app(scope, receive, send) return headers = {k.decode("latin-1").lower(): v.decode("latin-1") for k, v in scope.get("headers", [])} host = headers.get("host", "") def _same_origin(url: str) -> bool: if not url or not host: return False try: from urllib.parse import urlparse return urlparse(url).netloc == host except Exception: return False is_browser_same_origin = path != "/mcp" and ( _same_origin(headers.get("origin", "")) or _same_origin(headers.get("referer", "")) ) if is_browser_same_origin: await self.app(scope, receive, send) return expected = _ensure_external_api_key() provided = headers.get("x-api-key", "") if not provided and headers.get("authorization", "").lower().startswith("bearer "): provided = headers["authorization"][7:] if provided and provided == expected: await self.app(scope, receive, send) return import json as _json body = _json.dumps({"detail": "Missing or invalid API key — pass it as X-API-Key. Find/regenerate it in Settings > API Keys > External API Access."}).encode() await send({ "type": "http.response.start", "status": 401, "headers": [(b"content-type", b"application/json"), (b"content-length", str(len(body)).encode())], }) await send({"type": "http.response.body", "body": body}) app.add_middleware(ApiKeyGateMiddleware) # ── Routers ─────────────────────────────────────────────────────────────────── app.include_router(admin.router) app.include_router(settings.router) app.include_router(library.router) app.include_router(stt.router) app.include_router(sources.router) app.include_router(docker.router) app.include_router(tts.router) app.include_router(conversation.router) app.include_router(reader.router) app.include_router(characters.router) app.include_router(rehearsals_db.router) # ── Static files ────────────────────────────────────────────────────────────── app.mount("/static", StaticFiles(directory=str(STATIC_DIR)), name="static") # ── Dev runner ──────────────────────────────────────────────────────────────── if __name__ == "__main__": import uvicorn uvicorn.run(app, host="0.0.0.0", port=7890, log_level="info")