Refactor UI assets and harden quality checks

karldns/web/security_headers.py

@@ -2,10 +2,12 @@ from __future__ import annotations
 
 import logging
 import time
+from collections.abc import Awaitable, Callable
 
 from fastapi import FastAPI, Request
 from fastapi.responses import PlainTextResponse
 from starlette.concurrency import run_in_threadpool
+from starlette.responses import Response
 from starlette.types import ASGIApp, Message, Receive, Scope, Send
 
 from ..security import client_ip, is_rate_limited_path, rate_limit_bucket
@@ -13,6 +15,12 @@ from ..settings import DdnsSettings
 from ..store import DdnsStore
 
 ACCESS_LOGGER = logging.getLogger("karldns.access")
+SECRET_RESPONSE_PREFIXES = (
+    "/m/",
+    "/api/v1/hostnames",
+    "/api/v1/router/",
+    "/api/v1/admin/",
+)
 
 
 class RequestBodyTooLargeError(Exception):
@@ -49,7 +57,7 @@ class RequestBodyLimitMiddleware:
 
 def install_security_middleware(app: FastAPI, settings: DdnsSettings, store: DdnsStore) -> None:
     @app.middleware("http")
-    async def security_middleware(request: Request, call_next):
+    async def security_middleware(request: Request, call_next: Callable[[Request], Awaitable[Response]]) -> Response:
         started_at = time.perf_counter()
         try:
             content_length = int(request.headers.get("content-length", "0") or "0")
@@ -102,14 +110,12 @@ def is_admin_path(path: str, settings: DdnsSettings) -> bool:
 
 def is_secret_response(request: Request) -> bool:
     path = request.url.path
-    settings = request.app.state.settings
-    if is_admin_path(path, settings) or path.startswith("/m/"):
-        return True
-    if path.startswith(("/api/v1/hostnames", "/api/v1/router/")):
-        return True
-    if path.startswith("/api/v1/admin/"):
-        return True
-    return request.method == "POST" and path == "/"
+    return (
+        is_admin_path(path, request.app.state.settings)
+        or path.startswith(SECRET_RESPONSE_PREFIXES)
+        or request.method == "POST"
+        and path == "/"
+    )
 
 
 def is_noindex_response(request: Request) -> bool: