app/security/secrets.py

"""Secret-key validation — prevent weak or leaked defaults in production."""
from app.config import settings

# Hard block — obvious placeholders only (app will not start)
_BLOCKED_KEYS = {
    "change-this",
    "secret",
    "your-secret-key",
    "dev-secret",
    "changeme",
    "password",
}

# Warn only — previously leaked or weak but may still be in HF secrets until user rotates
_WARN_KEYS = {
    "rankora-super-secret-jwt-key-2026-shoaib",
}


def validate_production_secrets() -> None:
    key = (settings.secret_key or "").strip()
    if not key:
        raise RuntimeError("SECRET_KEY is required — set it in Hugging Face Space secrets")
    if len(key) < 24:
        raise RuntimeError("SECRET_KEY must be at least 24 characters")
    low = key.lower()
    if low in _BLOCKED_KEYS or "change-this" in low:
        raise RuntimeError("SECRET_KEY is a default placeholder — set a unique random secret in HF Space settings")
    if key in _WARN_KEYS or low in {k.lower() for k in _WARN_KEYS}:
        print(
            "⚠️  SECURITY WARNING: SECRET_KEY matches a known weak/leaked value. "
            "Rotate it in HF Space → Settings → Secrets (use: openssl rand -hex 32)"
        )
    if settings.debug and settings.secret_key == "change-this":
        print("⚠️  WARNING: Using default SECRET_KEY in debug mode only")


def redact(value: str | None) -> str:
    """Redact secrets for logs/responses."""
    if not value:
        return ""
    if len(value) <= 8:
        return "***"
    return value[:3] + "***" + value[-2:]