feat: add API middleware for CORS, security, rate limiting - PR-6

src/auth.py

@@ -0,0 +1,11 @@
+from functools import wraps
+from flask import request, jsonify
+
+def require_api_key(f):
+    @wraps(f)
+    def decorated_function(*args, **kwargs):
+        api_key = request.headers.get('X-API-Key')
+        if api_key != 'your-secret-key':  # Replace with actual key or env var
+            return jsonify({'error': 'API key required'}), 401
+        return f(*args, **kwargs)
+    return decorated_function

src/rate_limiter.py

@@ -0,0 +1,21 @@
+from collections import defaultdict
+from datetime import datetime, timedelta
+from flask import abort, current_app
+
+# Simple rate limiter using memory (use Redis for production)
+rate_limit = defaultdict(list)
+
+def rate_limit(max_requests=100, window_minutes=1):
+    def decorator(f):
+        @wraps(f)
+        def decorated_function(*args, **kwargs):
+            client_ip = request.remote_addr
+            now = datetime.utcnow()
+            window_start = now - timedelta(minutes=window_minutes)
+            rate_limit[client_ip] = [req_time for req_time in rate_limit[client_ip] if req_time > window_start]
+            if len(rate_limit[client_ip]) >= max_requests:
+                abort(429, description="Rate limit exceeded")
+            rate_limit[client_ip].append(now)
+            return f(*args, **kwargs)
+        return decorated_function
+    return decorator

src/security/auth.py

@@ -0,0 +1,45 @@
+from fastapi import Depends, HTTPException, status
+from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
+from jose import JWTError, jwt
+from passlib.context import CryptContext
+from datetime import datetime, timedelta
+from typing import Optional
+
+# Security settings
+SECRET_KEY = "your-secret-key"  # Should be loaded from config
+ALGORITHM = "HS256"
+ACCESS_TOKEN_EXPIRE_MINUTES = 30
+
+pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+security = HTTPBearer()
+
+def verify_password(plain_password, hashed_password):
+    return pwd_context.verify(plain_password, hashed_password)
+
+def get_password_hash(password):
+    return pwd_context.hash(password)
+
+def create_access_token(data: dict, expires_delta: Optional[timedelta] = None):
+    to_encode = data.copy()
+    if expires_delta:
+        expire = datetime.utcnow() + expires_delta
+    else:
+        expire = datetime.utcnow() + timedelta(minutes=15)
+    to_encode.update({"exp": expire})
+    encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
+    return encoded_jwt
+
+async def get_current_user(credentials: HTTPAuthorizationCredentials = Depends(security)):
+    credentials_exception = HTTPException(
+        status_code=status.HTTP_401_UNAUTHORIZED,
+        detail="Could not validate credentials",
+        headers={"WWW-Authenticate": "Bearer"},
+    )
+    try:
+        payload = jwt.decode(credentials.credentials, SECRET_KEY, algorithms=[ALGORITHM])
+        username: str = payload.get("sub")
+        if username is None:
+            raise credentials_exception
+    except JWTError:
+        raise credentials_exception
+    return username

src/security/rate_limiter.py

@@ -0,0 +1,31 @@
+from collections import defaultdict
+from datetime import datetime, timedelta
+from typing import Optional
+import time
+
+class RateLimiter:
+    def __init__(self, max_requests: int = 100, window_seconds: int = 3600):
+        self.max_requests = max_requests
+        self.window_seconds = window_seconds
+        self.requests = defaultdict(list)
+
+    def is_allowed(self, identifier: str) -> bool:
+        now = time.time()
+        window_start = now - self.window_seconds
+        self.requests[identifier] = [
+            timestamp for timestamp in self.requests[identifier]
+            if timestamp > window_start
+        ]
+        if len(self.requests[identifier]) < self.max_requests:
+            self.requests[identifier].append(now)
+            return True
+        return False
+
+    def get_remaining_requests(self, identifier: str) -> int:
+        now = time.time()
+        window_start = now - self.window_seconds
+        self.requests[identifier] = [
+            timestamp for timestamp in self.requests[identifier]
+            if timestamp > window_start
+        ]
+        return max(0, self.max_requests - len(self.requests[identifier]))

src/unified_api_server.py

@@ -0,0 +1,20 @@
+from flask import Flask, jsonify
+from flask_cors import CORS
+from auth import require_api_key
+from rate_limiter import rate_limit
+
+app = Flask(__name__)
+CORS(app)  # Enable CORS for all routes
+
+@app.route('/api/health')
+def health():
+    return jsonify({'status': 'healthy'})
+
+@app.route('/api/protected', methods=['POST'])
+@require_api_key
+@rate_limit(max_requests=10, window_minutes=1)
+def protected():
+    return jsonify({'message': 'Protected endpoint'})
+
+if __name__ == '__main__':
+    app.run(host='0.0.0.0', port=5000)