Update app/app.py

app/app.py

@@ -1,8 +1,10 @@
-# app/app.py
 from flask import Flask, request, jsonify
 import os
 import logging
 from waitress import serve
+from nacl.signing import VerifyKey
+from nacl.exceptions import BadSignatureError
+import json
 
 # Logging konfigurieren
 logging.basicConfig(
@@ -11,45 +13,83 @@ logging.basicConfig(
 )
 logger = logging.getLogger(__name__)
 
+# Konfiguration aus Umgebungsvariablen
+PUBLIC_KEY = os.getenv('Public_Key')
+APPLICATION_ID = os.getenv('Application_ID')
+
+if not PUBLIC_KEY or not APPLICATION_ID:
+    logger.error("Missing required environment variables!")
+    logger.error("Please set Public_Key and Application_ID in Hugging Face Spaces variables")
+    raise ValueError("Missing required environment variables")
+
 app = Flask(__name__)
+verify_key = VerifyKey(bytes.fromhex(PUBLIC_KEY))
+
+def verify_discord_request():
+    signature = request.headers.get('X-Signature-Ed25519')
+    timestamp = request.headers.get('X-Signature-Timestamp')
+    
+    if not signature or not timestamp:
+        logger.warning("Missing Discord signature headers")
+        return False
+    
+    try:
+        body = request.data.decode('utf-8')
+        verify_key.verify(f"{timestamp}{body}".encode(), bytes.fromhex(signature))
+        return True
+    except (BadSignatureError, Exception) as e:
+        logger.warning(f"Failed to verify request: {str(e)}")
+        return False
 
 @app.route("/", methods=["GET"])
 def health_check():
     logger.info("Health check endpoint called")
     return jsonify({
         "status": "healthy",
-        "message": "Discord bot is running on Hugging Face Spaces!"
+        "message": "Discord bot is running on Hugging Face Spaces!",
+        "application_id": APPLICATION_ID[:6] + "..." if APPLICATION_ID else "Not set",
+        "public_key_set": bool(PUBLIC_KEY),
     })
 
 @app.route("/interactions", methods=["POST"])
 def interactions():
+    # Verify the request is from Discord
+    if not verify_discord_request():
+        logger.warning("Failed to verify Discord request")
+        return "Invalid request signature", 401
+
     if not request.is_json:
         logger.warning("Received non-JSON request")
         return jsonify({"error": "Expected JSON data"}), 400
 
-    data = request.json
-    logger.info(f"Received interaction: {data.get('type')}")
-    
-    # Discord Ping Verification
-    if data.get("type") == 1:
-        logger.info("Responding to ping verification")
-        return jsonify({"type": 1})
-    
-    # Slash Command Handler
-    if data.get("type") == 2:
-        command = data.get("data", {}).get("name")
-        logger.info(f"Received command: {command}")
-        if command == "settings":
-            return jsonify({
-                "type": 4,
-                "data": {
-                    "content": "Hier sind die aktuellen Einstellungen deiner App."
-                }
-            })
-    
-    return jsonify({"error": "Unknown interaction type"}), 400
+    try:
+        data = request.json
+        logger.info(f"Received verified interaction type: {data.get('type')}")
+        
+        # Discord Ping Verification
+        if data.get("type") == 1:
+            logger.info("Responding to ping verification")
+            return jsonify({"type": 1})
+        
+        # Slash Command Handler
+        if data.get("type") == 2:
+            command = data.get("data", {}).get("name")
+            logger.info(f"Received command: {command}")
+            if command == "settings":
+                return jsonify({
+                    "type": 4,
+                    "data": {
+                        "content": f"🔧 Bot Einstellungen:\n• Application ID: {APPLICATION_ID[:6]}...\n• Verifizierung: ✅ Aktiv"
+                    }
+                })
+        
+        return jsonify({"error": "Unknown interaction type"}), 400
+        
+    except Exception as e:
+        logger.error(f"Error processing request: {str(e)}")
+        return jsonify({"error": "Internal server error"}), 500
 
 if __name__ == "__main__":
-    logger.info("Starting Discord bot on Hugging Face Spaces...")
-    # Für Hugging Face Spaces nutzen wir Waitress statt development server
+    logger.info(f"Starting Discord bot (Application ID: {APPLICATION_ID[:6]}...)")
+    logger.info("Public Key verification is enabled")
     serve(app, host="0.0.0.0", port=8080)