Draft: Implement DRF API Key security gateway for V3 endpoints

Author: NamanmeetSingh

requirements.txt

@@ -39,6 +39,7 @@ docopt==0.6.2
 docutils==0.17.1
 drf-spectacular==0.24.2
 drf-spectacular-sidecar==2022.10.1
+djangorestframework-api-key>=3.0.0
 executing==0.8.3
 fetchcode==0.8.2
 freezegun==1.2.1

setup.cfg

@@ -106,6 +106,8 @@ install_requires =
     #hashid
     uritemplate
 
+    djangorestframework-api-key>=3.0.0
+
 
 [options.extras_require]
 dev =

vulnerabilities/api.py

@@ -22,6 +22,7 @@
 from rest_framework import viewsets
 from rest_framework.decorators import action
 from rest_framework.response import Response
+from rest_framework_api_key.permissions import HasAPIKey
 
 from vulnerabilities.models import Alias
 from vulnerabilities.models import Exploit
@@ -471,6 +472,7 @@ class PackageViewSet(viewsets.ReadOnlyModelViewSet):
     filter_backends = (filters.DjangoFilterBackend,)
     filterset_class = PackageFilterSet
     throttle_classes = [PermissionBasedUserRateThrottle]
+    permission_classes = [HasAPIKey]
 
     def get_queryset(self):
         return super().get_queryset().with_is_vulnerable()

vulnerabilities/api_v2.py

@@ -43,6 +43,7 @@
 from vulnerabilities.throttling import PermissionBasedUserRateThrottle
 from vulnerabilities.utils import group_advisories_by_content
 
+from rest_framework_api_key.permissions import HasAPIKey
 
 class CharInFilter(filters.BaseInFilter, filters.CharFilter):
     pass
@@ -1070,6 +1071,7 @@ class PackageV3ViewSet(viewsets.ReadOnlyModelViewSet):
     filter_backends = [filters.DjangoFilterBackend]
     filterset_class = AdvisoryPackageV2FilterSet
     throttle_classes = [AnonRateThrottle, PermissionBasedUserRateThrottle]
+    permission_classes = [HasAPIKey]
 
     def get_queryset(self):
         return (

vulnerablecode/settings.py

@@ -83,6 +83,7 @@
     "django_filters",
     "rest_framework",
     "rest_framework.authtoken",
+    'rest_framework_api_key',
     "widget_tweaks",
     "crispy_forms",
     "crispy_bootstrap4",