feat: security api key

Author: rebecamurillo

.env.example

@@ -18,4 +18,6 @@ API_VERSION=0.1.0
 
 # CRITICAL, FATAL, ERROR, WARN, WARNING, INFO, DEBUG, NOTSET
 LOG_LEVEL=DEBUG
-LOG_FORMAT=json
+LOG_FORMAT=json
+
+INTERNAL_API_KEY=xxx

src/sum_impact_assessment/api/dependencies/__init__.py

@@ -0,0 +1,3 @@
+"""
+API dependencies package.
+"""

src/sum_impact_assessment/api/dependencies/auth.py

@@ -0,0 +1,20 @@
+"""
+Authentication dependencies for API routes.
+"""
+from fastapi import HTTPException, Security, status
+from fastapi.security import APIKeyHeader
+from ...config.settings import settings
+
+
+api_key_header = APIKeyHeader(name="X-Internal-API-Key", auto_error=False)
+
+
+async def verify_api_key(api_key: str = Security(api_key_header)) -> None:
+    """
+    Verify internal API key sent in request headers.
+    """
+    if not api_key or api_key != settings.INTERNAL_API_KEY:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or missing API key"
+        )

src/sum_impact_assessment/api/main.py

@@ -2,9 +2,10 @@
 FastAPI application instance and configuration.
 """
 import time
-from fastapi import FastAPI, Request
+from fastapi import Depends, FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
 from .routes import kpis, jobs, simulation, health
+from .dependencies.auth import verify_api_key
 from ..config.settings import settings
 from ..utils.logger import get_logger
 from ..database.connection import Base, engine
@@ -74,9 +75,9 @@ async def log_requests(request: Request, call_next):
 
 # Include routers
 app.include_router(health.router, tags=["Health"])
-app.include_router(kpis.router, tags=["KPIs"])
-app.include_router(jobs.router, tags=["Jobs"])
-app.include_router(simulation.router, tags=["Simulation (NON-prod only)⚠️"])
+app.include_router(kpis.router, tags=["KPIs"], dependencies=[Depends(verify_api_key)])
+app.include_router(jobs.router, tags=["Jobs"], dependencies=[Depends(verify_api_key)])
+app.include_router(simulation.router, tags=["Simulation (NON-prod only)⚠️"], dependencies=[Depends(verify_api_key)])
 
 
 @app.on_event("startup")

src/sum_impact_assessment/config/settings.py

@@ -22,6 +22,7 @@ class Settings(BaseSettings):
     API_PORT: int = 8000
     API_TITLE: str = "SUM Impact Assessment API"
     API_VERSION: str = __version__
+    INTERNAL_API_KEY: str = ""
 
     # Application configuration
     LOG_LEVEL: str = "INFO"

tests/test_api/test_jobs.py

@@ -1,18 +1,23 @@
 """
 Unit tests for job management API.
 """
+import os
 import pytest
 from unittest.mock import Mock, patch, MagicMock
 from fastapi import status
 from fastapi.testclient import TestClient
 from datetime import datetime
+
+os.environ["INTERNAL_API_KEY"] = "test-key"
+
 from src.sum_impact_assessment.api.main import app
 from sum_impact_assessment.database.models.job import JobRun
 from src.sum_impact_assessment.schemas.job import JobNameEnum, JobStatusEnum
 
 
 # Create test client
 client = TestClient(app)
+AUTH_HEADERS = {"X-Internal-API-Key": "test-key"}
 
 
 class TestJobsAPI:
@@ -43,7 +48,7 @@ def test_trigger_job_success(self, mock_get_job_class, mock_job_repo_class):
         mock_get_job_class.return_value = mock_job_class
 
         # Make request
-        response = client.post("/jobs/runs/kpi_measures_analysis")
+        response = client.post("/jobs/runs/kpi_measures_analysis", headers=AUTH_HEADERS)
 
         # Assertions
         assert response.status_code == status.HTTP_201_CREATED
@@ -68,7 +73,7 @@ def test_trigger_job_not_found_in_registry(self, mock_get_job_class, mock_job_re
         mock_get_job_class.side_effect = KeyError("Job not found")
 
         # Make request
-        response = client.post("/jobs/runs/kpi_measures_analysis")
+        response = client.post("/jobs/runs/kpi_measures_analysis", headers=AUTH_HEADERS)
 
         # Assertions
         assert response.status_code == status.HTTP_404_NOT_FOUND
@@ -80,7 +85,7 @@ def test_trigger_job_not_found_in_registry(self, mock_get_job_class, mock_job_re
     def test_trigger_job_invalid_job_name(self):
         """Test triggering a job with invalid job name returns 422."""
         # Make request with invalid job name
-        response = client.post("/jobs/runs/invalid_job_name")
+        response = client.post("/jobs/runs/invalid_job_name", headers=AUTH_HEADERS)
 
         # Assertions
         assert response.status_code == status.HTTP_422_UNPROCESSABLE_ENTITY
@@ -100,7 +105,7 @@ def test_trigger_job_database_error(self, mock_get_job_class, mock_job_repo_clas
         mock_job_repo_class.return_value = mock_repo_instance
 
         # Make request
-        response = client.post("/jobs/runs/kpi_measures_analysis")
+        response = client.post("/jobs/runs/kpi_measures_analysis", headers=AUTH_HEADERS)
 
         # Assertions
         assert response.status_code == status.HTTP_500_INTERNAL_SERVER_ERROR
@@ -133,6 +138,7 @@ def test_trigger_job_with_params(self, mock_get_job_class, mock_job_repo_class):
         # Make request with params
         response = client.post(
             "/jobs/runs/mcda_analysis_quantitative",
+            headers=AUTH_HEADERS,
             json={"params": {"kpi_group_type": "MCDA_GOALS"}}
         )
 
@@ -168,7 +174,7 @@ def test_trigger_mcda_analysis_job(self, mock_get_job_class, mock_job_repo_class
         mock_get_job_class.return_value = mock_job_class
 
         # Make request
-        response = client.post("/jobs/runs/mcda_analysis_quantitative")
+        response = client.post("/jobs/runs/mcda_analysis_quantitative", headers=AUTH_HEADERS)
 
         # Assertions
         assert response.status_code == status.HTTP_201_CREATED
@@ -207,6 +213,7 @@ def test_trigger_mcda_analysis_job_with_perspective(self, mock_get_job_class, mo
         # Make request with perspective parameter
         response = client.post(
             "/jobs/runs/mcda_analysis_quantitative",
+            headers=AUTH_HEADERS,
             json={"params": {"perspective": "regulatory"}}
         )
 

tests/test_api/test_simulation.py

@@ -1,14 +1,19 @@
 """
 Unit tests for simulation API routes.
 """
+import os
 import pytest
 from unittest.mock import Mock, patch, MagicMock
 from fastapi import status
 from fastapi.testclient import TestClient
+
+os.environ["INTERNAL_API_KEY"] = "test-key"
+
 from src.sum_impact_assessment.api.main import app
 
 # Create test client
 client = TestClient(app)
+AUTH_HEADERS = {"X-Internal-API-Key": "test-key"}
 
 
 class TestSimulationAPI:
@@ -23,6 +28,7 @@ def test_simulation_blocked_in_production(self, mock_settings):
         # Attempt to run simulation
         response = client.post(
             "/simulation/kpi-results",
+            headers=AUTH_HEADERS,
             json={
                 "baseline_years": [2023],
                 "target_year": 2025,
@@ -55,6 +61,7 @@ def test_simulation_success_in_development(self, mock_service_class, mock_settin
         # Run simulation
         response = client.post(
             "/simulation/kpi-results",
+            headers=AUTH_HEADERS,
             json={
                 "baseline_years": [2023],
                 "target_year": 2025,
@@ -87,6 +94,7 @@ def test_simulation_invalid_parameters(self, mock_service_class, mock_settings):
         # Run simulation with invalid params
         response = client.post(
             "/simulation/kpi-results",
+            headers=AUTH_HEADERS,
             json={
                 "baseline_years": [2025],
                 "target_year": 2023,  # Invalid: target < baseline
@@ -104,7 +112,7 @@ def test_environment_status_development(self, mock_settings):
         """Test environment status endpoint in development."""
         mock_settings.ENV = "development"
 
-        response = client.get("/simulation/environment")
+        response = client.get("/simulation/environment", headers=AUTH_HEADERS)
 
         assert response.status_code == status.HTTP_200_OK
         data = response.json()
@@ -116,7 +124,7 @@ def test_environment_status_production(self, mock_settings):
         """Test environment status endpoint in production."""
         mock_settings.ENV = "production"
 
-        response = client.get("/simulation/environment")
+        response = client.get("/simulation/environment", headers=AUTH_HEADERS)
 
         assert response.status_code == status.HTTP_200_OK
         data = response.json()