fix: read CORS allowed origins from ALLOWED_ORIGINS env secret

app/main.py

@@ -5,7 +5,9 @@ import socket
 from urllib.parse import urlparse
 
 import requests as http_requests
-from fastapi import FastAPI, File, HTTPException, UploadFile
+from fastapi import Depends, FastAPI, File, HTTPException, UploadFile
+from fastapi.middleware.cors import CORSMiddleware
+from fastapi.security import APIKeyHeader
 from PIL import Image, UnidentifiedImageError
 
 from app.model import MammogramModel
@@ -17,7 +19,29 @@ ALLOWED_HOSTS: set[str] = {
     h.strip().lower() for h in _ALLOWED_HOSTS_ENV.split(",") if h.strip()
 }
 
+_API_KEY = os.getenv("API_KEY", "")
+_api_key_header = APIKeyHeader(name="X-API-Key", auto_error=False)
+
+
+def _require_api_key(key: str | None = Depends(_api_key_header)) -> None:
+    if not _API_KEY:
+        return  # API_KEY not configured — open in dev/mock mode
+    if key != _API_KEY:
+        raise HTTPException(status_code=401, detail="Invalid or missing API key")
+
+
 app = FastAPI(title="Mammogram Inference API", version="0.1.0")
+
+_CORS_ORIGINS = [
+    o.strip() for o in os.getenv("ALLOWED_ORIGINS", "").split(",") if o.strip()
+]
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=_CORS_ORIGINS,
+    allow_methods=["POST", "GET"],
+    allow_headers=["Content-Type", "X-API-Key"],
+)
+
 model = MammogramModel()
 
 
@@ -26,7 +50,7 @@ def health() -> dict:
     return {"status": "ok", "model_mode": model.mode, "model_version": model.version}
 
 
-@app.post("/predict", response_model=PredictResponse)
+@app.post("/predict", response_model=PredictResponse, dependencies=[Depends(_require_api_key)])
 async def predict(file: UploadFile = File(...)) -> PredictResponse:
     if not file.content_type or not file.content_type.startswith("image/"):
         raise HTTPException(status_code=400, detail="Upload must be an image file")
@@ -66,7 +90,7 @@ def _validate_url(url: str) -> str:
     return url
 
 
-@app.post("/analyze", response_model=PredictResponse)
+@app.post("/analyze", response_model=PredictResponse, dependencies=[Depends(_require_api_key)])
 def analyze(body: AnalyzeRequest) -> PredictResponse:
     """Accept a public image URL, download it, and run inference."""
     _validate_url(body.image_url)