Upload core/config.py with huggingface_hub

core/config.py

@@ -20,8 +20,8 @@ class Settings(BaseSettings):
 
     # Security
     # Secrets must be provided via environment variables in production
-    SECRET_KEY: str = "_aLyTWEFoGSIPaoZAKmA0YRDobiKANPQeH9rCKzxdLw="
-    JWT_SECRET_KEY: str = "_aLyTWEFoGSIPaoZAKmA0YRDobiKANPQeH9rCKzxdLw="
+    SECRET_KEY: str
+    JWT_SECRET_KEY: str
     JWT_ALGORITHM: str = "HS256"
     JWT_ACCESS_TOKEN_EXPIRE_MINUTES: int = 30
     FIELD_ENCRYPTION_KEY: Optional[str] = None
@@ -38,6 +38,12 @@ class Settings(BaseSettings):
     prometheus_url: Optional[str] = None
     mcp_profile: str = "development"
 
+    # Auth Hardening
+    # When True, allows usage of "mock_" tokens for testing.
+    # MUST be False in production.
+    ALLOW_MOCK_AUTH: bool = False
+    MFA_REQUIRED_FOR_ADMIN: bool = True
+
     # AI Configuration
     AI_MODEL_PATH: str = "models/isolation_forest.pkl"
     AI_TRAINING_INTERVAL_HOURS: int = 24
@@ -45,7 +51,9 @@ class Settings(BaseSettings):
     HF_TOKEN: Optional[str] = None
 
     # Security - Certificate Pinning
-    TRUSTED_PUBLIC_KEY_HASHES: list[str] = ["dummy_hash_for_development"]  # Replace with actual hashes in production
+    TRUSTED_PUBLIC_KEY_HASHES: list[str] = [
+        "dummy_hash_for_development"
+    ]  # Replace with actual hashes in production
 
     # File Upload Configuration
     MAX_UPLOAD_SIZE: int = 10 * 1024 * 1024  # 10MB
@@ -67,7 +75,9 @@ class Settings(BaseSettings):
     AWS_SECRET_ACCESS_KEY: Optional[str] = None
     AWS_REGION: str = "us-east-1"
 
-    model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8", extra="ignore")
+    model_config = SettingsConfigDict(
+        env_file=".env", env_file_encoding="utf-8", extra="ignore"
+    )
 
 
 # Validate required settings
@@ -77,11 +87,14 @@ settings = Settings()
 # Manual validation for encryption key to ensure secure startup
 def get_encryption_key() -> str:
     """Retrieves the encryption key from environment variables, raising an error if not found."""
-    key = os.environ.get("FIELD_ENCRYPTION_KEY") or os.environ.get("ENCRYPTION_KEY") or os.environ.get("SECRET_KEY")
+    key = (
+        os.environ.get("FIELD_ENCRYPTION_KEY")
+        or os.environ.get("ENCRYPTION_KEY")
+        or os.environ.get("SECRET_KEY")
+    )
     if not key:
-        # For development/testing, use a fallback if not provided in env
-        # In production, this should ideally be explicitly set
-        return "_aLyTWEFoGSIPaoZAKmA0YRDobiKANPQeH9rCKzxdLw="
+        # In production, this must be explicitly set
+        raise ValueError("Encryption key configuration is missing. Please set FIELD_ENCRYPTION_KEY, ENCRYPTION_KEY, or SECRET_KEY.")
     return key