Patched code sample

import os
import sys
import psutil
import shutil
from typing import Optional

from fastapi import FastAPI, Depends, Header, HTTPException, status
from pydantic import BaseModel, Field

# --- Configuration ---
# In a real application, this would be loaded from environment variables.
ADMIN_API_KEY = "fixed-secret-api-key-required-for-details"
DB_FILESYSTEM_PATH = "/var/data/mcp/memory.db"

# This represents the vulnerable setting. Even if true, the fix ensures the
# sensitive endpoint remains protected.
MCP_ALLOW_ANONYMOUS_ACCESS = True


# --- FastAPI Application Setup ---
# This code represents the patched version (e.g., 10.21.0 or later).
app = FastAPI(
    title="MCP Memory Service (Patched)",
    version="10.21.0",
)


# --- Pydantic Models for Response Payloads ---
class BasicHealthResponse(BaseModel):
    status: str = "ok"

class DetailedHealthResponse(BaseModel):
    os_version: str
    python_version: str
    cpu_count: int
    memory_total_gb: float
    disk_total_gb: float
    disk_free_gb: float
    database_path: str


# --- Authentication Dependency (THE FIX) ---
# This dependency function is the core of the fix. It is applied to any
# endpoint that must be protected, ensuring an authorization check occurs
# before the endpoint's logic is executed.
async def require_admin_authentication(x_admin_api_key: Optional[str] = Header(None)):
    """
    Checks for a valid admin API key in the request headers.
    If the key is missing or incorrect, it raises an HTTP 401 Unauthorized error.
    """
    if not x_admin_api_key or x_admin_api_key != ADMIN_API_KEY:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="A valid X-Admin-API-Key header is required for this endpoint",
        )


# --- API Endpoints ---

@app.get(
    "/api/health",
    tags=["Health"],
    summary="Public Basic Health Check",
    response_model=BasicHealthResponse
)
async def get_basic_health():
    """
    A basic, non-sensitive health check that can remain public.
    This endpoint does not have the authentication dependency.
    """
    return {"status": "ok"}


@app.get(
    "/api/health/detailed",
    tags=["Health"],
    summary="Protected Detailed System Health Information",
    response_model=DetailedHealthResponse,
    # VULNERABILITY FIX: The `dependencies` list now includes the
    # `require_admin_authentication` check. This prevents unauthenticated
    # access to the sensitive information returned by this endpoint.
    dependencies=[Depends(require_admin_authentication)],
)
async def get_detailed_health():
    """
    Returns detailed and sensitive system information. Access is now restricted
    to authenticated users only, resolving the information disclosure vulnerability.
    """
    mem = psutil.virtual_memory()
    disk = shutil.disk_usage("/")
    try:
        # os.uname() is not available on Windows
        os_info = f"{sys.platform} {os.uname().release}"
    except AttributeError:
        os_info = f"{sys.platform} {sys.getwindowsversion().major}.{sys.getwindowsversion().minor}"

    return DetailedHealthResponse(
        os_version=os_info,
        python_version=sys.version,
        cpu_count=os.cpu_count() or 0,
        memory_total_gb=round(mem.total / (1024 ** 3), 2),
        disk_total_gb=round(disk.total / (1024 ** 3), 2),
        disk_free_gb=round(disk.free / (1024 ** 3), 2),
        database_path=DB_FILESYSTEM_PATH,
    )