fix: login_required accepts ADMIN_API_KEY env var for clean programmatic auth

Author: WattCoin-Org

admin_blueprint.py

@@ -117,19 +117,22 @@ def get_tier_rate_limit(tier):
 # AUTH
 # =============================================================================
 
+ADMIN_API_KEY = os.getenv("ADMIN_API_KEY", "")
+
 def login_required(f):
     """Decorator to require login for admin routes.
-    Accepts session auth OR X-Admin-Key header matching ADMIN_PASSWORD.
+    Accepts session auth OR X-Admin-Key header matching ADMIN_PASSWORD or ADMIN_API_KEY.
     """
     @functools.wraps(f)
     def decorated_function(*args, **kwargs):
         # API key auth for programmatic access (e.g., RunPod training pipeline)
-        if request.headers.get('X-Admin-Key') and ADMIN_PASSWORD:
-            if request.headers.get('X-Admin-Key') == ADMIN_PASSWORD:
+        api_key = request.headers.get('X-Admin-Key', '')
+        if api_key:
+            if (ADMIN_PASSWORD and api_key == ADMIN_PASSWORD) or (ADMIN_API_KEY and api_key == ADMIN_API_KEY):
                 return f(*args, **kwargs)
+            return jsonify({"error": "Unauthorized"}), 401
         if not session.get('admin_logged_in'):
-            # Return JSON 401 for API requests, redirect for browser
-            if request.headers.get('Accept', '').startswith('application/json') or request.headers.get('X-Admin-Key'):
+            if request.headers.get('Accept', '').startswith('application/json'):
                 return jsonify({"error": "Unauthorized"}), 401
             return redirect(url_for('admin.login'))
         return f(*args, **kwargs)