Add API key authentication

- Integrated auth.py into model_service.py endpoints
- All endpoints now require X-API-Key header when API_KEY env var is set
- Created setup instructions for HuggingFace Spaces configuration

README.md

@@ -2,29 +2,33 @@
 title: Visualisable AI Backend
 emoji: 🧠
 colorFrom: blue
-colorTo: purple
+colorTo: green
 sdk: docker
 pinned: false
 ---
 
-# Visualisable.ai Backend
+# Visualisable.ai Backend Service
 
 This is the backend service for Visualisable.ai, providing:
-- AI model inference API
-- WebSocket connections for real-time traces
-- Integration with the frontend deployed on Vercel
+
+- Real-time model inference with trace extraction
+- WebSocket streaming for live visualization
+- REST API for model information and generation
 
 ## API Endpoints
 
-- `GET /health` - Health check
-- `POST /generate` - Generate code with AI
-- `GET /model/info` - Get model information
+- `GET /` - Health check
+- `GET /health` - Detailed health status
+- `GET /model/info` - Model architecture details
+- `POST /generate` - Generate text with traces
 - `WebSocket /ws` - Real-time trace streaming
 
-## Frontend
+## Configuration
 
-The frontend is deployed at: https://visualisable-ai.vercel.app
+Set the following secrets in your Space settings:
 
-## Local Development
+- `API_KEY` (optional) - API key for authentication
+
+## Frontend
 
-See the main repository: https://github.com/gary-boon/visualisable-ai
+The frontend is deployed separately on Vercel. Connect it by setting the backend URL in your frontend environment variables.

backend/model_service.py

@@ -3,7 +3,7 @@ Unified Model Service for Visualisable.ai
 Combines model loading, generation, and trace extraction into a single service
 """
 
-from fastapi import FastAPI, WebSocket, WebSocketDisconnect, BackgroundTasks, HTTPException
+from fastapi import FastAPI, WebSocket, WebSocketDisconnect, BackgroundTasks, HTTPException, Depends
 from fastapi.middleware.cors import CORSMiddleware
 from pydantic import BaseModel
 import asyncio
@@ -15,6 +15,7 @@ import numpy as np
 import logging
 from datetime import datetime
 import traceback
+from .auth import verify_api_key
 
 # Configure logging
 logging.basicConfig(level=logging.INFO)
@@ -440,7 +441,7 @@ async def health():
     }
 
 @app.get("/model/info")
-async def model_info():
+async def model_info(authenticated: bool = Depends(verify_api_key)):
     """Get detailed information about the loaded model"""
     if not manager.model:
         raise HTTPException(status_code=503, detail="Model not loaded")
@@ -486,7 +487,7 @@ async def model_info():
     }
 
 @app.post("/generate")
-async def generate(request: GenerationRequest):
+async def generate(request: GenerationRequest, authenticated: bool = Depends(verify_api_key)):
     """Generate text with optional trace extraction"""
     result = await manager.generate_with_traces(
         prompt=request.prompt,
@@ -497,7 +498,7 @@ async def generate(request: GenerationRequest):
     return result
 
 @app.get("/demos")
-async def list_demos():
+async def list_demos(authenticated: bool = Depends(verify_api_key)):
     """List available demo prompts"""
     return {
         "demos": [
@@ -529,7 +530,7 @@ async def list_demos():
     }
 
 @app.post("/demos/run")
-async def run_demo(request: DemoRequest):
+async def run_demo(request: DemoRequest, authenticated: bool = Depends(verify_api_key)):
     """Run a specific demo"""
     demos = {
         "fibonacci": "def fibonacci(n):\n    '''Calculate fibonacci number'''",

setup-api-key.md

@@ -0,0 +1,45 @@
+# API Key Setup Instructions
+
+## Generated API Key
+```
+c5fd7c64cf05a6cbfae3a8cdc4edb25fa4735b324489776fdcf114aefba12748
+```
+
+## Steps to Add to HuggingFace Spaces:
+
+1. Go to your HuggingFace Space: https://huggingface.co/spaces/garyboon/visualisable-ai-backend
+2. Click on "Settings" (gear icon) in the top right
+3. Scroll down to "Repository secrets"
+4. Click "New secret"
+5. Add:
+   - Name: `API_KEY`
+   - Value: `c5fd7c64cf05a6cbfae3a8cdc4edb25fa4735b324489776fdcf114aefba12748`
+6. Click "Add new secret"
+
+## Frontend Configuration
+
+Add this API key to your frontend environment variables:
+
+### For Vercel:
+1. Go to your Vercel project settings
+2. Navigate to Environment Variables
+3. Add:
+   - Name: `NEXT_PUBLIC_API_KEY`
+   - Value: `c5fd7c64cf05a6cbfae3a8cdc4edb25fa4735b324489776fdcf114aefba12748`
+
+### For local development:
+Create `.env.local` in your frontend directory:
+```
+NEXT_PUBLIC_API_KEY=c5fd7c64cf05a6cbfae3a8cdc4edb25fa4735b324489776fdcf114aefba12748
+NEXT_PUBLIC_API_URL=https://garyboon-visualisable-ai-backend.hf.space
+```
+
+## Testing the API Key
+
+Once configured, test with:
+```bash
+curl -H "X-API-Key: c5fd7c64cf05a6cbfae3a8cdc4edb25fa4735b324489776fdcf114aefba12748" \
+  https://garyboon-visualisable-ai-backend.hf.space/health
+```
+
+Should return the health status if the key is correctly configured.