HexaWetter v1.2.0: Security, Admin, Radar, UI

api/app/security.py

@@ -0,0 +1,70 @@
+from __future__ import annotations
+
+import logging
+import secrets
+from typing import Iterable
+
+from fastapi import Request
+from fastapi.responses import JSONResponse
+
+from app.config import ALLOWED_HOSTS, API_KEY, REQUIRE_API_KEY
+
+logger = logging.getLogger(__name__)
+
+API_KEY_EXEMPT_PATHS: frozenset[str] = frozenset(
+    {
+        "/api/health",
+        "/api/admin/login",
+        "/api/admin/status",
+    }
+)
+
+
+def api_key_configured() -> bool:
+    return bool(API_KEY)
+
+
+def api_key_required() -> bool:
+    return REQUIRE_API_KEY or api_key_configured()
+
+
+def validate_security_config() -> None:
+    if REQUIRE_API_KEY and not API_KEY:
+        raise RuntimeError("REQUIRE_API_KEY is enabled but API_KEY is not set. Generate one with: python scripts/setup_secrets.py")
+    if API_KEY and len(API_KEY) < 24:
+        raise RuntimeError("API_KEY must be at least 24 characters")
+    if api_key_configured() and not REQUIRE_API_KEY:
+        logger.warning("API_KEY is set but REQUIRE_API_KEY=false — API key auth is still enforced when API_KEY is present")
+    if not api_key_configured() and not REQUIRE_API_KEY:
+        logger.warning("API is running without API_KEY — set API_KEY and REQUIRE_API_KEY=true for production")
+
+
+def is_api_key_exempt(path: str) -> bool:
+    return path in API_KEY_EXEMPT_PATHS
+
+
+def extract_api_key(request: Request) -> str:
+    return request.headers.get("X-API-Key", "").strip()
+
+
+def verify_request_api_key(request: Request) -> bool:
+    if not api_key_required():
+        return True
+    provided = extract_api_key(request)
+    if not provided:
+        return False
+    return secrets.compare_digest(provided, API_KEY)
+
+
+def cors_allowed_origins() -> list[str]:
+    from app.config import ALLOWED_ORIGINS
+
+    if ALLOWED_ORIGINS:
+        return list(ALLOWED_ORIGINS)
+    if api_key_required():
+        return []
+    return ["*"]
+
+
+def trusted_hosts() -> Iterable[str]:
+    return ALLOWED_HOSTS