http-api: T8989: address review comments

- Make ApiModel.key optional to allow Bearer/X-API-Key/mTLS auth
  without requiring a dummy key field in the request body
- Add thread safety to REST token secret initialization
- Cast rest_token_exp and rest_secret_len to int on load
- Use defensive dict.get() for authentication config access

1 files changed, 7 insertions, 3 deletions

diff --git a/src/services/vyos-http-api-server b/src/services/vyos-http-api-server
index 4039d17a2..bdcf24e39 100755
--- a/src/services/vyos-http-api-server
+++ b/src/services/vyos-http-api-server
@@ -184,9 +184,13 @@ def initialization(session: SessionState, app: FastAPI = app):
     rest_config = server_config.get('rest', {})
     session.debug = bool('debug' in rest_config)
     session.strict = bool('strict' in rest_config)
-    if isinstance(rest_config, dict) and 'authentication' in rest_config:
-        session.rest_token_exp = rest_config['authentication']['expiration']
-        session.rest_secret_len = rest_config['authentication']['secret_length']
+    if isinstance(rest_config, dict):
+        auth = rest_config.get('authentication', {})
+        if isinstance(auth, dict):
+            if 'expiration' in auth:
+                session.rest_token_exp = int(auth['expiration'])
+            if 'secret_length' in auth:
+                session.rest_secret_len = int(auth['secret_length'])
 
     graphql_config = server_config.get('graphql', {})
     session.origins = graphql_config.get('cors', {}).get('allow_origin', [])