fix(security): Settings API uses real encryption, never returns raw keys

backend/app/api/routes/settings.py

@@ -1,24 +1,26 @@
 """
-Settings routes - API key management, user preferences.
+Settings routes - API key management with REAL encryption.
 """
 import uuid
 from datetime import datetime
 
 from fastapi import APIRouter, HTTPException, status
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 from sqlalchemy import select
 
 from app.api.deps import CurrentUser, DBSession
+from app.core.encryption import encrypt_api_key, decrypt_api_key, mask_api_key
 from app.models.user import User, UserAPIKey
 
 router = APIRouter(prefix="/settings", tags=["settings"])
 
 
-# ----- Schemas -----
+VALID_PROVIDERS = ["openai", "anthropic", "google", "mistral", "deepseek", "xai", "huggingface"]
+
 
 class APIKeyCreate(BaseModel):
     provider: str
-    key: str
+    key: str = Field(min_length=10, max_length=500)
     label: str | None = None
 
 
@@ -26,6 +28,7 @@ class APIKeyResponse(BaseModel):
     id: str
     provider: str
     label: str | None
+    masked_key: str  # Only shows sk-...last4
     is_active: bool
     created_at: datetime
 
@@ -40,14 +43,11 @@ class APIKeysListResponse(BaseModel):
 class UserPreferencesUpdate(BaseModel):
     default_provider: str | None = None
     default_model: str | None = None
-    theme: str | None = None
-
 
-# ----- Routes -----
 
 @router.get("/api-keys", response_model=APIKeysListResponse)
 async def list_api_keys(db: DBSession, user: CurrentUser):
-    """List user's API keys (without exposing the actual key values)."""
+    """List user's API keys (NEVER exposes actual key values)."""
     result = await db.execute(
         select(UserAPIKey).where(UserAPIKey.user_id == user.id).order_by(UserAPIKey.created_at.desc())
     )
@@ -58,6 +58,7 @@ async def list_api_keys(db: DBSession, user: CurrentUser):
                 id=str(k.id),
                 provider=k.provider,
                 label=k.label,
+                masked_key=mask_api_key(decrypt_api_key(k.encrypted_key) or "****"),
                 is_active=k.is_active,
                 created_at=k.created_at,
             )
@@ -68,35 +69,26 @@ async def list_api_keys(db: DBSession, user: CurrentUser):
 
 @router.post("/api-keys", response_model=APIKeyResponse, status_code=status.HTTP_201_CREATED)
 async def add_api_key(data: APIKeyCreate, db: DBSession, user: CurrentUser):
-    """Add an API key for a provider."""
-    # Validate provider
-    valid_providers = ["openai", "anthropic", "google", "mistral", "deepseek", "xai", "huggingface"]
-    if data.provider not in valid_providers:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f"Invalid provider. Must be one of: {', '.join(valid_providers)}",
-        )
+    """Add an API key — encrypted at rest with Fernet."""
+    if data.provider not in VALID_PROVIDERS:
+        raise HTTPException(status_code=400, detail=f"Provider must be: {', '.join(VALID_PROVIDERS)}")
 
-    # Check if key already exists for this provider
+    # Check existing
     existing = await db.execute(
         select(UserAPIKey).where(
-            UserAPIKey.user_id == user.id,
-            UserAPIKey.provider == data.provider,
-            UserAPIKey.is_active == True,
+            UserAPIKey.user_id == user.id, UserAPIKey.provider == data.provider, UserAPIKey.is_active == True
         )
     )
     if existing.scalar_one_or_none():
-        raise HTTPException(
-            status_code=status.HTTP_409_CONFLICT,
-            detail=f"Active key already exists for {data.provider}. Delete it first.",
-        )
+        raise HTTPException(status_code=409, detail=f"Active key exists for {data.provider}. Delete first.")
+
+    # Encrypt the key
+    encrypted = encrypt_api_key(data.key)
 
-    # In production: encrypt the key before storing
-    # For now, store as-is (add encryption layer before deploying)
     key = UserAPIKey(
         user_id=user.id,
         provider=data.provider,
-        encrypted_key=data.key,  # TODO: encrypt with user-specific key
+        encrypted_key=encrypted,
         label=data.label or f"{data.provider} key",
         is_active=True,
     )
@@ -108,6 +100,7 @@ async def add_api_key(data: APIKeyCreate, db: DBSession, user: CurrentUser):
         id=str(key.id),
         provider=key.provider,
         label=key.label,
+        masked_key=mask_api_key(data.key),
         is_active=key.is_active,
         created_at=key.created_at,
     )
@@ -121,7 +114,7 @@ async def delete_api_key(key_id: uuid.UUID, db: DBSession, user: CurrentUser):
     )
     key = result.scalar_one_or_none()
     if not key:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="API key not found")
+        raise HTTPException(status_code=404, detail="API key not found")
     await db.delete(key)
 
 
@@ -132,4 +125,4 @@ async def update_preferences(data: UserPreferencesUpdate, db: DBSession, user: C
     update_data = data.model_dump(exclude_unset=True)
     prefs.update(update_data)
     user.llm_preferences = prefs
-    return {"detail": "Preferences updated", "preferences": prefs}
+    return {"detail": "Updated", "preferences": prefs}