Update app.py

app.py

@@ -5,7 +5,7 @@ import warnings
 import logging
 import urllib.parse
 from concurrent.futures import ThreadPoolExecutor
-from fastapi import FastAPI, File, UploadFile, Form, HTTPException
+from fastapi import FastAPI, File, UploadFile, Form, HTTPException, Header
 from fastapi.middleware.cors import CORSMiddleware
 from PIL import Image
 import io
@@ -21,11 +21,24 @@ logging.getLogger("transformers").setLevel(logging.ERROR)
 
 app = FastAPI()
 
+# --- GÜVENLİK AYARLARI ---
+# API Key - Gerçek uygulamada environment variable kullanın
+API_KEY = os.getenv("PURESENSE_API_KEY", "ps_live_2024_secure_key_x7k9m")
+
+# İzin verilen originler (CORS)
+ALLOWED_ORIGINS = [
+    "https://puresense.app",
+    "capacitor://localhost",
+    "http://localhost",
+    "http://localhost:3000",
+    "http://127.0.0.1",
+]
+
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],
+    allow_origins=ALLOWED_ORIGINS,
     allow_credentials=True,
-    allow_methods=["*"],
+    allow_methods=["GET", "POST"],
     allow_headers=["*"],
 )
 
@@ -593,7 +606,15 @@ def get_skin_type(image):
 def home(): return {"status": "Pure Sense API v10 (Curated Products)"}
 
 @app.post("/analyze")
-async def analyze_skin(file: UploadFile = File(...), is_premium: bool = Form(False)):
+async def analyze_skin(
+    file: UploadFile = File(...), 
+    is_premium: bool = Form(False),
+    x_api_key: str = Header(None, alias="X-API-Key")
+):
+    # API Key doğrulaması
+    if x_api_key != API_KEY:
+        raise HTTPException(status_code=401, detail="Geçersiz veya eksik API anahtarı")
+    
     contents = await file.read()
     
     is_valid, msg = check_image_quality(contents)