feat: security api key

Author: rebecamurillo

.env.example

@@ -18,4 +18,6 @@ API_VERSION=0.1.0
 
 # CRITICAL, FATAL, ERROR, WARN, WARNING, INFO, DEBUG, NOTSET
 LOG_LEVEL=DEBUG
-LOG_FORMAT=json
+LOG_FORMAT=json
+
+INTERNAL_API_KEY=xxx

src/sum_impact_assessment/api/dependencies/__init__.py

@@ -0,0 +1,3 @@
+"""
+API dependencies package.
+"""

src/sum_impact_assessment/api/dependencies/auth.py

@@ -0,0 +1,20 @@
+"""
+Authentication dependencies for API routes.
+"""
+from fastapi import HTTPException, Security, status
+from fastapi.security import APIKeyHeader
+from ...config.settings import settings
+
+
+api_key_header = APIKeyHeader(name="X-Internal-API-Key", auto_error=False)
+
+
+async def verify_api_key(api_key: str = Security(api_key_header)) -> None:
+    """
+    Verify internal API key sent in request headers.
+    """
+    if not api_key or api_key != settings.INTERNAL_API_KEY:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or missing API key"
+        )

src/sum_impact_assessment/api/main.py

@@ -2,9 +2,10 @@
 FastAPI application instance and configuration.
 """
 import time
-from fastapi import FastAPI, Request
+from fastapi import Depends, FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
 from .routes import kpis, jobs, simulation, health
+from .dependencies.auth import verify_api_key
 from ..config.settings import settings
 from ..utils.logger import get_logger
 from ..database.connection import Base, engine
@@ -74,9 +75,9 @@ async def log_requests(request: Request, call_next):
 
 # Include routers
 app.include_router(health.router, tags=["Health"])
-app.include_router(kpis.router, tags=["KPIs"])
-app.include_router(jobs.router, tags=["Jobs"])
-app.include_router(simulation.router, tags=["Simulation (NON-prod only)⚠️"])
+app.include_router(kpis.router, tags=["KPIs"], dependencies=[Depends(verify_api_key)])
+app.include_router(jobs.router, tags=["Jobs"], dependencies=[Depends(verify_api_key)])
+app.include_router(simulation.router, tags=["Simulation (NON-prod only)⚠️"], dependencies=[Depends(verify_api_key)])
 
 
 @app.on_event("startup")

src/sum_impact_assessment/config/settings.py

@@ -22,6 +22,7 @@ class Settings(BaseSettings):
     API_PORT: int = 8000
     API_TITLE: str = "SUM Impact Assessment API"
     API_VERSION: str = __version__
+    INTERNAL_API_KEY: str = ""
 
     # Application configuration
     LOG_LEVEL: str = "INFO"