Hardening admin security: moving credentials to environment variables

app/admin/router.py

@@ -41,9 +41,7 @@ from fastapi.responses import HTMLResponse, JSONResponse, StreamingResponse
 logger = logging.getLogger(__name__)
 settings = get_settings()
 
-# ── Credentials (stored as constants — in production, move to env vars) ───────
-ADMIN_USERNAME = "martech_admin"
-ADMIN_PASSWORD = "martech_admin_303"
+# Credentials are now loaded from settings (environment variables)
 
 # ── Security scheme ───────────────────────────────────────────────────────────
 security = HTTPBasic()
@@ -68,11 +66,11 @@ def verify_admin(credentials: HTTPBasicCredentials = Depends(security)) -> str:
     """
     correct_username = secrets.compare_digest(
         credentials.username.encode("utf-8"),
-        ADMIN_USERNAME.encode("utf-8"),
+        settings.admin_user.encode("utf-8"),
     )
     correct_password = secrets.compare_digest(
         credentials.password.encode("utf-8"),
-        ADMIN_PASSWORD.encode("utf-8"),
+        settings.admin_pass.encode("utf-8"),
     )
     if not (correct_username and correct_password):
         logger.warning(
@@ -104,8 +102,8 @@ async def request_otp(req: LoginRequest):
     Verifies password and generates a 6-digit OTP.
     Sends the OTP to the configured admin email.
     """
-    if not (secrets.compare_digest(req.username, ADMIN_USERNAME) and 
-            secrets.compare_digest(req.password, ADMIN_PASSWORD)):
+    if not (secrets.compare_digest(req.username, settings.admin_user) and 
+            secrets.compare_digest(req.password, settings.admin_pass)):
         raise HTTPException(status_code=401, detail="Invalid credentials.")
     
     # Generate 6-digit code
@@ -188,8 +186,8 @@ def send_otp_email(to_email: str, otp_code: str):
 async def verify_otp(req: OTPVerifyRequest):
     """Verifies both the password and the OTP code."""
     # 1. Verify password first
-    if not (secrets.compare_digest(req.username, ADMIN_USERNAME) and 
-            secrets.compare_digest(req.password, ADMIN_PASSWORD)):
+    if not (secrets.compare_digest(req.username, settings.admin_user) and 
+            secrets.compare_digest(req.password, settings.admin_pass)):
         raise HTTPException(status_code=401, detail="Invalid credentials.")
     
     # 2. Verify OTP

app/core/config.py

@@ -50,6 +50,8 @@ class Settings(BaseSettings):
     smtp_user: str = Field(default="", alias="SMTP_USER")
     smtp_pass: str = Field(default="", alias="SMTP_PASS")
     admin_email: str = Field(default="randomjoedown@gmail.com", alias="ADMIN_EMAIL")
+    admin_user: str = Field(default="martech_admin", alias="ADMIN_USER")
+    admin_pass: str = Field(default="martech_admin_303", alias="ADMIN_PASS")
 
 
 @lru_cache