Merge pull request #14 from CoreyLeath-code/fix/require-production-api-key

Require API key for production serving

Author: CoreyLeath-code

README.md

@@ -162,6 +162,8 @@ API_KEY='replace-me' \
 uvicorn app.main:app --host 0.0.0.0 --port 8000
 ```
 
+In production, `API_KEY` is mandatory. When it is unset, recommendation and feedback requests return HTTP 503 so a deployment cannot silently expose unauthenticated endpoints. Development intentionally permits an unset key for local smoke tests.
+
 ```bash
 curl -X POST http://localhost:8000/recommendations/ \
   -H 'Content-Type: application/json' \

app/api/routes.py

@@ -89,6 +89,10 @@ class FeedbackRequest(BaseModel):
 
 
 def _authorize(api_key: str | None) -> None:
+    """Enforce configured authentication for production recommendation traffic."""
+
+    if settings.environment.lower() == "production" and not settings.api_key:
+        raise HTTPException(status_code=503, detail="Production API key is not configured")
     if not api_key_is_valid(api_key, settings.api_key):
         raise HTTPException(status_code=401, detail="Invalid API key")
 

tests/test_serving_controls.py

@@ -1,3 +1,8 @@
+import pytest
+from fastapi import HTTPException
+
+from app.api.routes import _authorize
+from app.core.config import settings
 from app.core.security import api_key_is_valid
 from app.core.serving import RateLimiter, RecommendationCache
 
@@ -22,3 +27,20 @@ def test_api_key_validation() -> None:
     assert api_key_is_valid(None, None) is True
     assert api_key_is_valid("correct", "correct") is True
     assert api_key_is_valid("wrong", "correct") is False
+
+
+def test_production_without_api_key_fails_closed(monkeypatch) -> None:
+    monkeypatch.setattr(settings, "environment", "production")
+    monkeypatch.setattr(settings, "api_key", None)
+
+    with pytest.raises(HTTPException) as error:
+        _authorize(None)
+
+    assert error.value.status_code == 503
+
+
+def test_development_without_api_key_remains_open(monkeypatch) -> None:
+    monkeypatch.setattr(settings, "environment", "development")
+    monkeypatch.setattr(settings, "api_key", None)
+
+    _authorize(None)