fix: enhance API key validation and implement stale IP eviction in rate limiting

app/routes/commend/router.py

@@ -117,14 +117,27 @@ class CommendHealthResponse(BaseModel):
 
 _COMMEND_API_KEY = os.getenv("COMMEND_API_KEY")
 _COMMEND_POSTING_ENABLED = os.getenv("COMMEND_ENABLE_POSTING", "false").lower() == "true"
+_COMMEND_REQUIRE_AUTH = os.getenv("COMMEND_REQUIRE_AUTH", "true").lower() != "false"
 
 # Simple in-memory rate limiter: IP -> list of timestamps
 _rate_limit_store: dict[str, list[float]] = defaultdict(list)
 _RATE_LIMIT_WINDOW = 60  # seconds
 _RATE_LIMIT_MAX = 10  # requests per window
+_MAX_TRACKED_IPS = 10_000
+
+
+def _evict_stale_ips() -> None:
+    """Remove expired entries when map grows beyond threshold."""
+    if len(_rate_limit_store) <= _MAX_TRACKED_IPS:
+        return
+    cutoff = time.time() - _RATE_LIMIT_WINDOW
+    stale_keys = [ip for ip, ts in _rate_limit_store.items() if all(t <= cutoff for t in ts)]
+    for key in stale_keys:
+        del _rate_limit_store[key]
 
 
 def _check_rate_limit(client_ip: str) -> None:
+    _evict_stale_ips()
     now = time.time()
     window_start = now - _RATE_LIMIT_WINDOW
     timestamps = _rate_limit_store[client_ip]
@@ -142,17 +155,29 @@ async def _require_api_key(
     request: Request,
     x_api_key: Optional[str] = Header(None, alias="X-API-Key"),
 ) -> None:
-    """Validate API key if COMMEND_API_KEY is configured."""
+    """Validate API key. Fail-closed: if COMMEND_REQUIRE_AUTH is true (default)
+    and no COMMEND_API_KEY is configured, all requests are rejected."""
+    client_ip = request.client.host if request.client else "unknown"
+
+    # Always apply rate-limit regardless of auth configuration
+    _check_rate_limit(client_ip)
+
     if not _COMMEND_API_KEY:
-        # No key configured — allow (development mode)
+        if _COMMEND_REQUIRE_AUTH:
+            # Fail-closed: auth required but no key configured
+            logger.error("COMMEND_API_KEY not set but auth is required. Rejecting request.")
+            raise HTTPException(
+                status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+                detail={"code": "auth_not_configured", "message": "Service authentication is not configured."}
+            )
+        # Explicitly opted out of auth (COMMEND_REQUIRE_AUTH=false)
         return
     if x_api_key != _COMMEND_API_KEY:
-        logger.warning(f"Unauthorized commend request from {request.client.host if request.client else 'unknown'}")
+        logger.warning(f"Unauthorized commend request from {client_ip}")
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail={"code": "unauthorized", "message": "Invalid or missing API key."}
         )
-    _check_rate_limit(request.client.host if request.client else "unknown")
 
 
 # --- API Endpoints ---