new

app.py

@@ -633,12 +633,17 @@ def log_request(response):
     return response
 
 def _require_admin():
-    if not _key_ok(ADMIN_API_KEY): return None
-    provided = request.headers.get("X-Admin-Key","")
+    # If ADMIN_API_KEY is not configured, block ALL admin operations
+    if not _key_ok(ADMIN_API_KEY):
+        return jsonify({"error": "Admin key not configured on server — admin endpoints disabled"}), 403
+    # Get key from header or JSON body
+    provided = request.headers.get("X-Admin-Key", "")
     if not provided and request.is_json:
-        provided = (request.get_json() or {}).get("admin_key","")
-    if provided != ADMIN_API_KEY:
-        return jsonify({"error":"Unauthorized — X-Admin-Key required"}), 403
+        provided = (request.get_json() or {}).get("admin_key", "")
+    # Constant-time comparison to prevent timing attacks
+    import hmac
+    if not provided or not hmac.compare_digest(provided, ADMIN_API_KEY):
+        return jsonify({"error": "Unauthorized — invalid or missing X-Admin-Key"}), 403
     return None
 
 SKIP = ("chrome://","about:","chrome-extension://","moz-extension://",

templates/dashboard.html

@@ -491,16 +491,23 @@ function sendFeedback(correctLabel){
 
 document.getElementById('si').addEventListener('keydown',function(e){if(e.key==='Enter')doScan()});
 
-// ── Retrain Trigger ───────────────────────────────────────────────────────────
+// ── Retrain Trigger (requires admin key) ──────────────────────────────────────
 function doRetrain(){
   var b=document.querySelector('.rtbtn');
+  var key=prompt('Enter Admin API Key to trigger retrain:');
+  if(!key||!key.trim()){b.textContent='⚠ Cancelled';setTimeout(function(){b.textContent='⚡ TRIGGER RETRAIN'},2000);return;}
   b.textContent='⏳ RETRAINING…';b.disabled=true;
-  fetch('/retrain/trigger',{method:'POST'})
+  fetch('/retrain/trigger',{
+    method:'POST',
+    headers:{'Content-Type':'application/json','X-Admin-Key':key.trim()},
+    body:JSON.stringify({})
+  })
     .then(function(r){return r.json()})
     .then(function(d){
-      b.textContent=d.status==='triggered'?'✓ RETRAIN STARTED':'⚠ '+d.message;
+      if(d.error){b.textContent='🔒 '+d.error;}
+      else{b.textContent=d.status==='triggered'?'✓ RETRAIN STARTED':'⚠ '+(d.message||d.status);}
       setTimeout(function(){b.textContent='⚡ TRIGGER RETRAIN';b.disabled=false},3000);
-    }).catch(function(){b.textContent='⚠ OFFLINE';setTimeout(function(){b.textContent='⚡ TRIGGER RETRAIN';b.disabled=false},3000)});
+    }).catch(function(){b.textContent='⚠ OFFLINE';setTimeout(function(){b.textContent='⚡ TRIGGER RETRAIN';b.disabled=false},3000);});
 }
 
 /* AUTO REFRESH — fetch stats every 60s instead of hard reload (FIX L3) */