Sync from GitHub via hub-sync

api/v1/auth.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
 
-from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi import APIRouter, Depends, HTTPException, Request, status
 from loguru import logger
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session
@@ -11,6 +11,7 @@ from db.database import get_db
 from db.models import User
 from schemas.auth import LoginBody, RegisterBody, TokenResponse, UserOut
 from services.auth_service import authenticate, create_access_token, register_user
+from services.rate_limit import ANON_AUTH_LOGIN, ANON_AUTH_REGISTER, limiter
 
 router = APIRouter(prefix="/auth", tags=["auth"])
 
@@ -23,23 +24,31 @@ def _token_response(user: User) -> TokenResponse:
     )
 
 
+@limiter.limit(ANON_AUTH_REGISTER)
 @router.post("/register", response_model=TokenResponse, status_code=status.HTTP_201_CREATED)
-def register(body: RegisterBody, db: Session = Depends(get_db)) -> TokenResponse:
+def register(body: RegisterBody, request: Request, db: Session = Depends(get_db)) -> TokenResponse:
     try:
         user = register_user(db, body.email, body.password, body.name)
     except IntegrityError:
         db.rollback()
+        client_host = request.client.host if request.client else "unknown"
+        logger.warning(f"Registration rejected email={body.email} ip={client_host}")
         raise HTTPException(status.HTTP_409_CONFLICT, "Email already registered")
-    logger.info(f"Registered user id={user.id} email={user.email}")
+    client_host = request.client.host if request.client else "unknown"
+    logger.info(f"Registered user id={user.id} email={user.email} ip={client_host}")
     return _token_response(user)
 
 
+@limiter.limit(ANON_AUTH_LOGIN)
 @router.post("/login", response_model=TokenResponse)
-def login(body: LoginBody, db: Session = Depends(get_db)) -> TokenResponse:
+def login(body: LoginBody, request: Request, db: Session = Depends(get_db)) -> TokenResponse:
     user = authenticate(db, body.email, body.password)
     if not user:
+        client_host = request.client.host if request.client else "unknown"
+        logger.warning(f"Login failed email={body.email} ip={client_host}")
         raise HTTPException(status.HTTP_401_UNAUTHORIZED, "Invalid email or password")
-    logger.info(f"Login user id={user.id} email={user.email}")
+    client_host = request.client.host if request.client else "unknown"
+    logger.info(f"Login user id={user.id} email={user.email} ip={client_host}")
     return _token_response(user)
 
 

api/v1/report.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 
 from pathlib import Path
 
-from fastapi import APIRouter, Depends, HTTPException, Request, status
+from fastapi import APIRouter, Depends, HTTPException, Query, Request, status
 from fastapi.responses import FileResponse
 from loguru import logger
 from sqlalchemy.orm import Session

api/v1/stats.py

@@ -3,13 +3,15 @@ from fastapi import APIRouter, Depends
 from sqlalchemy.orm import Session
 from sqlalchemy import func
 
+from api.deps import get_current_user
 from db.database import get_db
 from db.models import AnalysisRecord
+from db.models import User
 
 router = APIRouter(prefix="/stats", tags=["stats"])
 
 @router.get("/recent")
-def get_recent_stats(db: Session = Depends(get_db)):
+def get_recent_stats(user: User = Depends(get_current_user), db: Session = Depends(get_db)):
     """Phase 20.4 — Live Engagement Counter."""
     twenty_four_hours_ago = datetime.utcnow() - timedelta(hours=24)
     count = db.query(func.count(AnalysisRecord.id)).filter(AnalysisRecord.created_at >= twenty_four_hours_ago).scalar()

config.py

@@ -1,4 +1,5 @@
 import json
+import secrets
 from urllib.parse import parse_qsl, urlencode
 from typing import Any
 from pydantic import field_validator, model_validator
@@ -193,10 +194,24 @@ class Settings(BaseSettings):
     EXIFTOOL_PATH: str = ""  # full path to ExifTool binary; empty = metadata write disabled
 
     # Auth
-    JWT_SECRET_KEY: str = "change-me-in-production"
+    JWT_SECRET_KEY: str = ""
+    JWT_SECRET_KEY_GENERATED: bool = False
     JWT_ALGORITHM: str = "HS256"
     JWT_EXPIRATION_MINUTES: int = 1440
 
+    @model_validator(mode="after")
+    def ensure_jwt_secret(self):
+        if not self.JWT_SECRET_KEY:
+            if self.DEBUG:
+                self.JWT_SECRET_KEY = secrets.token_urlsafe(48)
+                self.JWT_SECRET_KEY_GENERATED = True
+            else:
+                self.JWT_SECRET_KEY = secrets.token_urlsafe(48)
+                self.JWT_SECRET_KEY_GENERATED = True
+        else:
+            self.JWT_SECRET_KEY_GENERATED = False
+        return self
+
     @field_validator("ALLOWED_IMAGE_TYPES", mode="before")
     @classmethod
     def assemble_allowed_image_types(cls, v: Any) -> list[str]:

db/database.py

@@ -47,15 +47,13 @@ def init_db():
     insp = inspect(engine)
     if "analyses" in insp.get_table_names():
         existing = {c["name"] for c in insp.get_columns("analyses")}
-        additions = {
-            "media_hash": "VARCHAR(64)",
-            "media_path": "VARCHAR(512)",
-            "thumbnail_url": "VARCHAR(512)",
-        }
         with engine.begin() as conn:
-            for col, ddl in additions.items():
-                if col not in existing:
-                    conn.execute(text(f"ALTER TABLE analyses ADD COLUMN {col} {ddl}"))
+            if "media_hash" not in existing:
+                conn.execute(text("ALTER TABLE analyses ADD COLUMN media_hash VARCHAR(64)"))
+            if "media_path" not in existing:
+                conn.execute(text("ALTER TABLE analyses ADD COLUMN media_path VARCHAR(512)"))
+            if "thumbnail_url" not in existing:
+                conn.execute(text("ALTER TABLE analyses ADD COLUMN thumbnail_url VARCHAR(512)"))
             # Indices (CREATE INDEX IF NOT EXISTS is SQLite+Postgres safe)
             for ddl in (
                 "CREATE INDEX IF NOT EXISTS ix_analyses_media_hash ON analyses (media_hash)",

logs/deepshield.log

@@ -949,3 +949,12 @@ TypeError: int() argument must be a string, a bytes-like object or a real number
 2026-04-26 22:09:45.469 | INFO     | services.report_service:generate_report:120 - Report generated id=43 path=temp_reports\deepshield_43_262befa5.pdf size=15602B
 2026-04-26 23:15:58.262 | INFO     | services.report_service:cleanup_expired:149 - Cleaned up 2 expired reports
 2026-04-27 01:22:14.691 | INFO     | services.report_service:cleanup_expired:149 - Cleaned up 2 expired reports
+2026-04-28 21:11:45.835 | INFO     | main:lifespan:108 - Starting DeepShield backend
+2026-04-28 21:11:45.871 | INFO     | main:lifespan:110 - Database initialized
+2026-04-28 21:11:45.871 | INFO     | models.model_loader:load_image_model:48 - Loading image model: prithivMLmods/Deep-Fake-Detector-v2-Model
+2026-04-28 21:11:51.313 | INFO     | models.model_loader:load_image_model:56 - Image model loaded
+2026-04-28 21:34:27.293 | INFO     | main:lifespan:118 - Shutting down DeepShield backend
+2026-04-28 21:34:41.654 | INFO     | main:lifespan:108 - Starting DeepShield backend
+2026-04-28 21:34:41.668 | INFO     | main:lifespan:110 - Database initialized
+2026-04-28 21:34:41.668 | INFO     | models.model_loader:load_image_model:48 - Loading image model: prithivMLmods/Deep-Fake-Detector-v2-Model
+2026-04-28 21:34:44.266 | INFO     | models.model_loader:load_image_model:56 - Image model loaded

main.py

@@ -11,7 +11,7 @@ from slowapi import _rate_limit_exceeded_handler
 from slowapi.errors import RateLimitExceeded
 
 from starlette.middleware.base import BaseHTTPMiddleware
-from starlette.responses import JSONResponse
+from starlette.responses import JSONResponse, RedirectResponse
 
 from api.router import api_router
 from config import settings
@@ -39,6 +39,21 @@ class ContentLengthLimitMiddleware(BaseHTTPMiddleware):
         return await call_next(request)
 
 
+class HTTPSRedirectAndHSTSMiddleware(BaseHTTPMiddleware):
+    async def dispatch(self, request, call_next):
+        if not settings.DEBUG:
+            forwarded_proto = request.headers.get("x-forwarded-proto", "").lower()
+            host = request.headers.get("host", "").split(":", 1)[0].lower()
+            if forwarded_proto != "https" and request.url.scheme != "https" and host not in {"127.0.0.1", "localhost", ""}:
+                https_url = request.url.replace(scheme="https")
+                return RedirectResponse(str(https_url), status_code=308)
+
+        response = await call_next(request)
+        if not settings.DEBUG:
+            response.headers.setdefault("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
+        return response
+
+
 # === Phase 15.3 — JWT / CORS / logging hardening ===
 
 _DEFAULT_JWT_SECRET = "change-me-in-production"
@@ -46,7 +61,7 @@ _DEFAULT_JWT_SECRET = "change-me-in-production"
 
 def _enforce_production_hardening() -> None:
     """Refuse to start in production with unsafe defaults (Phase 15.3)."""
-    if settings.JWT_SECRET_KEY == _DEFAULT_JWT_SECRET or not settings.JWT_SECRET_KEY:
+    if settings.JWT_SECRET_KEY == _DEFAULT_JWT_SECRET or not settings.JWT_SECRET_KEY or settings.JWT_SECRET_KEY_GENERATED:
         example = secrets.token_urlsafe(48)
         if settings.DEBUG:
             logger.warning(
@@ -131,6 +146,8 @@ app.state.limiter = limiter
 
 app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
 app.add_middleware(RateLimitContextMiddleware)
+# Phase 15.3 — enforce HTTPS in production and add HSTS
+app.add_middleware(HTTPSRedirectAndHSTSMiddleware)
 # Phase 15.3 — reject oversized uploads before reading body
 app.add_middleware(ContentLengthLimitMiddleware, max_bytes=settings.MAX_UPLOAD_SIZE_MB * 1024 * 1024)
 

schemas/auth.py

@@ -1,8 +1,9 @@
 from __future__ import annotations
 
+import re
 from datetime import datetime
 
-from pydantic import BaseModel, EmailStr, Field
+from pydantic import BaseModel, EmailStr, Field, field_validator
 
 
 class RegisterBody(BaseModel):
@@ -10,6 +11,21 @@ class RegisterBody(BaseModel):
     password: str = Field(min_length=6, max_length=128)
     name: str | None = Field(default=None, max_length=255)
 
+    @field_validator("password")
+    @classmethod
+    def validate_password_strength(cls, value: str) -> str:
+        if len(value) < 8:
+            raise ValueError("Password must be at least 8 characters long")
+        if not re.search(r"[a-z]", value):
+            raise ValueError("Password must include a lowercase letter")
+        if not re.search(r"[A-Z]", value):
+            raise ValueError("Password must include an uppercase letter")
+        if not re.search(r"\d", value):
+            raise ValueError("Password must include a digit")
+        if not re.search(r"[^A-Za-z0-9]", value):
+            raise ValueError("Password must include a symbol")
+        return value
+
 
 class LoginBody(BaseModel):
     email: EmailStr

services/auth_service.py

@@ -5,6 +5,7 @@ from typing import Any
 
 import bcrypt
 from jose import JWTError, jwt
+from loguru import logger
 from sqlalchemy.orm import Session
 
 from config import settings
@@ -24,7 +25,8 @@ def hash_password(plain: str) -> str:
 def verify_password(plain: str, hashed: str) -> bool:
     try:
         return bcrypt.checkpw(_encode_pw(plain), hashed.encode("utf-8"))
-    except Exception:
+    except Exception as exc:
+        logger.warning(f"Password verification failed due to malformed hash: {exc}")
         return False
 
 

services/rate_limit.py

@@ -80,6 +80,8 @@ ANON_ANALYZE = "5/hour"
 AUTH_ANALYZE = "50/hour"
 ANON_REPORT = "2/hour"
 AUTH_REPORT = "20/hour"
+ANON_AUTH_REGISTER = "5/hour"
+ANON_AUTH_LOGIN = "10/minute"
 
 limiter = Limiter(
     key_func=request_key,

utils/scoring.py

@@ -11,6 +11,12 @@ TRUST_SCALE = [
 ]
 
 
+def _validate_weight_total(weights: list[float], context: str) -> None:
+    total = sum(weights)
+    if total > 1.000001:
+        raise ValueError(f"{context} weights must not sum above 1.0 (got {total:.3f})")
+
+
 def compute_authenticity_score(fake_probability: float, label: str = "") -> int:
     """Map a fake probability [0.0, 1.0] to a 0-100 authenticity score.
 
@@ -62,8 +68,10 @@ def compute_video_authenticity_score(
     visual_score = (1.0 - float(mean_suspicious_prob)) * 100.0
     temporal_sc = float(temporal_score) if temporal_score is not None else visual_score
     if has_audio and audio_authenticity_score is not None:
+        _validate_weight_total([0.50, 0.30, 0.20], "video audio+temporal fusion")
         combined = 0.50 * visual_score + 0.30 * temporal_sc + 0.20 * float(audio_authenticity_score)
     else:
+        _validate_weight_total([0.70, 0.30], "video visual+temporal fusion")
         combined = 0.70 * visual_score + 0.30 * temporal_sc
     score = int(round(max(0.0, min(100.0, combined))))
     label, severity = get_verdict_label(score)