security: require a server-held shared secret for the compute routes

app.py

@@ -882,6 +882,46 @@ def _patched_create_app(blocks, **kwargs):
     except Exception as _se:
         _log(f"searxng bridge registration failed: {_se}")
 
+    # ── Shared-secret gate for the unauthenticated compute routes ────────────
+    # /respite/audio/generate, /respite/search, /respite/text/* and
+    # /respite/benchmark* had no authentication of any kind: any process on the
+    # internet could generate audio, run inference, and bill the Space owner's
+    # audio key and ZeroGPU hours. CORS is irrelevant to them — a server-side
+    # caller does not care what the browser enforces — so the boundary they
+    # were missing is a shared secret, not a header policy.
+    #
+    # The secret is read from the Space's own `RESPIRE_SPACE_KEY` setting and is
+    # never sent to a browser: the app holds it server-side and proxies through
+    # `/api/audio`. If the setting is absent the routes fail CLOSED, because a
+    # gate that opens when its key is missing is a gate that opens exactly when
+    # it is not configured.
+    try:
+        import hmac as _hmac
+
+        _SPACE_KEY = os.environ.get("RESpite_SPACE_KEY", "")
+        _PROTECTED_PREFIXES = (
+            "/respite/audio/",
+            "/respite/search",
+            "/respite/text/",
+            "/respite/benchmark",
+        )
+
+        @fa_app.middleware("http")
+        async def _respite_key_gate(request, call_next):
+            if request.url.path.startswith(_PROTECTED_PREFIXES):
+                if not _SPACE_KEY:
+                    return JSONResponse(
+                        {"error": "service not configured"}, status_code=503
+                    )
+                presented = request.headers.get("x-respite-key", "")
+                if not _hmac.compare_digest(presented, _SPACE_KEY):
+                    return JSONResponse({"error": "unauthorized"}, status_code=401)
+            return await call_next(request)
+
+        _log(f"compute routes key gate installed (key {'set' if _SPACE_KEY else 'MISSING'})")
+    except Exception as _ke:
+        _log(f"compute routes key gate FAILED to install: {_ke}")
+
     # ── CORS gate for /respite/* ────────────────────────────────────────────
     # Gradio installs a global CORS middleware that reflects the caller's
     # Origin and sets `Access-Control-Allow-Credentials: true`. Applied to the