Add app password protection

.env.example

@@ -0,0 +1,4 @@
+GROQ_API_KEY=
+GROQ_MODEL=
+APP_USERNAME=
+APP_PASSWORD=

.gitignore

@@ -0,0 +1,6 @@
+.env
+.env.*
+!.env.example
+
+__pycache__/
+*.py[cod]

README.md

@@ -4,11 +4,14 @@ sdk: docker
 app_port: 7860
 ---
 
-## Hugging Face Secrets
+## Environment
 
-Set these in the Space settings:
+For local development, copy `.env.example` to `.env` and fill only the values you need.
+Set production secrets in the Hugging Face Space settings, not in committed files.
 
 - `GROQ_API_KEY`: required for Groq model calls.
-- `HF_TOKEN`: optional, required only for the `Save Manual References` button.
+- `APP_PASSWORD`: optional, enables password protection for the running app.
+- `APP_USERNAME`: optional, defaults to `mastermap` when `APP_PASSWORD` is set.
+- `HF_TOKEN`: Hugging Face Space Secret only; optional, required only for the `Save Manual References` button.
 
 `Save Manual References` only enables on Hugging Face Spaces when `SPACE_ID` is present and `HF_TOKEN` is configured. It commits the current `refdata/manual_references.json` back to the Space repository.

src/config.py

@@ -8,6 +8,10 @@ load_dotenv()
 # --- ENVIRONMENT VARIABLES to be set up in .env ---
 GROQ_API_KEY = os.getenv("GROQ_API_KEY")
 RAW_MODELS = os.getenv("GROQ_MODEL", "")
+APP_USERNAME = os.getenv("APP_USERNAME", "")
+APP_PASSWORD = os.getenv("APP_PASSWORD", "")
+SPACE_ID = os.getenv("SPACE_ID", "")
+HF_TOKEN = os.getenv("HF_TOKEN", "")
 
 # Parse models cleanly into a list
 AVAILABLE_MODELS = [m.strip() for m in RAW_MODELS.split(",") if m.strip()]

src/utils.py

@@ -1,8 +1,9 @@
-import os
 from pathlib import Path
 import re
 import unicodedata
 
+from src.config import HF_TOKEN, SPACE_ID
+
 def strip_degrees_for_search(text):
     if not isinstance(text, str): return text
     degree_pattern = r'\b(MSc|MBA|BBA|BSc|Ph\.?D\.?|BA|MA|BS|MS|EMBA|Master|Bachelor|Masters|Bachelors|Licence)\b'
@@ -99,26 +100,23 @@ def prune_manual_refs_against_official(manual_refs, official_refs):
 MANUAL_REFERENCES_REPO_PATH = "refdata/manual_references.json"
 
 def reference_sync_status():
-    space_id = os.getenv("SPACE_ID", "")
-    has_token = bool(os.getenv("HF_TOKEN"))
-
-    if not space_id:
+    if not SPACE_ID:
         return {
             "enabled": False,
             "space_id": "",
             "reason": "Reference sync is only available on Hugging Face Spaces.",
         }
 
-    if not has_token:
+    if not HF_TOKEN:
         return {
             "enabled": False,
-            "space_id": space_id,
+            "space_id": SPACE_ID,
             "reason": "HF_TOKEN secret is missing from this Space.",
         }
 
     return {
         "enabled": True,
-        "space_id": space_id,
+        "space_id": SPACE_ID,
         "reason": "",
     }
 
@@ -136,7 +134,7 @@ def save_manual_references_to_hub(app_root: Path):
     except ImportError as exc:
         raise RuntimeError("huggingface_hub is not installed.") from exc
 
-    api = HfApi(token=os.environ["HF_TOKEN"])
+    api = HfApi(token=HF_TOKEN)
     commit_info = api.upload_file(
         path_or_fileobj=str(manual_refs_path),
         path_in_repo=MANUAL_REFERENCES_REPO_PATH,

ui_app.py

@@ -1,3 +1,4 @@
+import secrets
 import sys
 import uuid
 from pathlib import Path
@@ -5,7 +6,13 @@ from pathlib import Path
 from flask import Flask, Response, jsonify, render_template, request, send_file
 
 from newest_model import PREFERRED_PRODUCTION_CHAT_MODELS, select_groq_chat_models
-from src.config import AVAILABLE_MODELS, DATA_DIR, DEFAULT_OUTPUT_SHEET_NAME
+from src.config import (
+    APP_PASSWORD,
+    APP_USERNAME,
+    AVAILABLE_MODELS,
+    DATA_DIR,
+    DEFAULT_OUTPUT_SHEET_NAME,
+)
 from src.process_runner import stop_process, stream_process
 from src.utils import reference_sync_status, save_manual_references_to_hub
 from src.workbook_io import read_workbook_sheets, resolve_allowed_path, save_uploaded_excel
@@ -37,6 +44,33 @@ STATE = {
     "apply_blueprint_path": "",
     "apply_blueprint_filename": "",
 }
+
+
+def auth_required_response() -> Response:
+    return Response(
+        "Authentication required",
+        401,
+        {"WWW-Authenticate": 'Basic realm="MasterMap Cleaner"'},
+    )
+
+
+@app.before_request
+def require_basic_auth():
+    if not APP_PASSWORD:
+        return None
+
+    auth = request.authorization
+    if not auth:
+        return auth_required_response()
+
+    valid_username = secrets.compare_digest(auth.username or "", APP_USERNAME)
+    valid_password = secrets.compare_digest(auth.password or "", APP_PASSWORD)
+    if valid_username and valid_password:
+        return None
+
+    return auth_required_response()
+
+
 @app.after_request
 def prevent_browser_cache(response):
     response.headers["Cache-Control"] = "no-store, no-cache, must-revalidate, max-age=0"