diff --git a/app/keywarden/api/main.py b/app/keywarden/api/main.py
index ea7cc99..cf97bb1 100644
--- a/app/keywarden/api/main.py
+++ b/app/keywarden/api/main.py
@@ -1,7 +1,7 @@
import inspect
from typing import List, Optional
-from ninja import NinjaAPI, Router, Schema
+from ninja import NinjaAPI, Router, Schema, Redoc
from ninja.security import django_auth
from .security import JWTAuth
@@ -15,6 +15,7 @@ from .routers.access import build_router as build_access_router
from .routers.telemetry import build_router as build_telemetry_router
from .routers.agent import build_router as build_agent_router
+from django.contrib.admin.views.decorators import staff_member_required
def register_routers(target_api: NinjaAPI) -> None:
target_api.add_router("/system", build_system_router(), tags=["system"])
@@ -39,6 +40,8 @@ api = build_api(
version="1.0.0",
description="Authenticated API for internal app use and external clients.",
auth=[django_auth, JWTAuth()],
+ docs=Redoc(),
+ docs_decorator=staff_member_required,
)
register_routers(api)
@@ -48,5 +51,7 @@ api_v1 = build_api(
description="Authenticated API for internal app use and external clients.",
auth=[django_auth, JWTAuth()],
urls_namespace="api-v1",
+ docs=Redoc(),
+ docs_decorator=staff_member_required,
)
register_routers(api_v1)
diff --git a/app/templates/ninja/swagger.html b/app/templates/ninja/swagger.html
new file mode 100644
index 0000000..a4655bc
--- /dev/null
+++ b/app/templates/ninja/swagger.html
@@ -0,0 +1,32 @@
+{% load static %}
+
+
+
+
+
+ {{ title|default:"Keywarden API" }}
+
+
+
+
+
+
+
+
+
+
diff --git a/nginx/configs/options-http-headers.conf b/nginx/configs/options-http-headers.conf
index 9264753..a53dd1a 100644
--- a/nginx/configs/options-http-headers.conf
+++ b/nginx/configs/options-http-headers.conf
@@ -1,4 +1,4 @@
-add_header Content-Security-Policy "default-src 'self'; font-src *;img-src * data:; script-src * 'unsafe-eval'; style-src * 'unsafe-inline'";
+add_header Content-Security-Policy "default-src 'self'; font-src *;img-src * data:; script-src * 'unsafe-eval' 'unsafe-inline'; style-src * 'unsafe-inline'";
add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options nosniff;
add_header Referrer-Policy "strict-origin";