only allow access to start, move, end endpoint with the user agent BattlesnakeEngine

server/blueprints/battlesnake.py

@@ -3,6 +3,7 @@ import json, time, os
 
 from quart import Blueprint, request, jsonify
 
+from quart_common.web.decorators import require_user_agent
 from quart_common.web.logger import await_log
 from server.database import StorageLoader
 from snakes import DEFAULT_SNAKE_CONFIG
@@ -44,6 +45,7 @@ def create_battlesnake_blueprint(server:'Server') -> Blueprint:
     return snake_json
 
   @blueprint.post('/start')
+  @require_user_agent("BattlesnakeEngine", abort_code=404)
   async def on_start():
     server.metrics_collector.record_http_request('start')
     await server.game_runtime.prune_stale_games()
@@ -54,6 +56,7 @@ def create_battlesnake_blueprint(server:'Server') -> Blueprint:
     return 'ok'
 
   @blueprint.post('/move')
+  @require_user_agent("BattlesnakeEngine", abort_code=404)
   async def on_move():
     server.metrics_collector.record_http_request('move')
     game_state = await request.get_json()
@@ -71,6 +74,7 @@ def create_battlesnake_blueprint(server:'Server') -> Blueprint:
     return {'move': next_move}
 
   @blueprint.post('/end')
+  @require_user_agent("BattlesnakeEngine", abort_code=404)
   async def on_end():
     server.metrics_collector.record_http_request('end')
     await server.game_runtime.prune_stale_games()
@@ -98,9 +102,9 @@ def create_battlesnake_blueprint(server:'Server') -> Blueprint:
     await server.metrics_collector.record_game_end(game_state)
     return 'ok'
 
-  @blueprint.get('/cleanup')
-  async def cleanup():
-    results = server._cleanup_database()
-    return jsonify(data=json.loads(results), status=200)
+  # @blueprint.get('/cleanup')
+  # async def cleanup():
+  #   results = server._cleanup_database()
+  #   return jsonify(data=json.loads(results), status=200)
 
   return blueprint

server/blueprints/metrics.py

@@ -1,4 +1,4 @@
-from quart_common.web.decorators import restrict_ip_addresses
+from quart_common.web.decorators import restrict_ip_addresses, require_user_agent
 
 from quart import Blueprint, jsonify
 from typing import TYPE_CHECKING
@@ -10,7 +10,7 @@ def create_metrics_blueprint(server:'Server') -> Blueprint:
   blueprint = Blueprint('metrics', __name__)
 
   @blueprint.get('/metrics')
-  @restrict_ip_addresses(allow=['192.168.188.0/24', '192.168.200.0/24'], abort_code=404)
+  @restrict_ip_addresses(allow=['127.0.0.1', '192.168.200.0/24'], abort_code=404)
   async def metrics():
     snapshot = await server.metrics_collector.build_snapshot(
       server.game_runtime.game_last_seen_unix,
@@ -19,7 +19,8 @@ def create_metrics_blueprint(server:'Server') -> Blueprint:
     return jsonify(snapshot)
 
   @blueprint.get('/metrics/prometheus')
-  @restrict_ip_addresses(allow=['192.168.188.0/24', '192.168.200.0/24'], abort_code=404)
+  @restrict_ip_addresses(allow=['127.0.0.1', '192.168.188.0/24', '192.168.200.0/24'], abort_code=404)
+  @require_user_agent("prometheus", abort_code=404)
   async def metrics_prometheus():
     snapshot = await server.metrics_collector.build_snapshot(
       server.game_runtime.game_last_seen_unix,