fix: enforce X-AutoAlt-Key validation on scanstart, progress, result, and report endpoints

api.py

@@ -1,4 +1,4 @@
-from fastapi import FastAPI, BackgroundTasks, Query, Header, HTTPException
+from fastapi import FastAPI, BackgroundTasks, Query, Header, HTTPException, Depends
 from fastapi.middleware.cors import CORSMiddleware as CORS
 from fastapi.responses import JSONResponse, FileResponse
 from fastapi.staticfiles import StaticFiles
@@ -23,6 +23,22 @@ logger = logging.getLogger("API")
 # Securely load the key from Hugging Face environment variables
 SECRET_KEY = os.getenv("AUTOALT_SECRET_KEY")
 
+def verify_key(
+    x_autoalt_key: Optional[str] = Header(None, alias="X-AutoAlt-Key"),
+    key: Optional[str] = Query(None),
+    x_key: Optional[str] = Query(None, alias="x_autoalt_key")
+):
+    token = x_autoalt_key or key or x_key
+    # Block if the header/key is missing
+    if not token:
+        raise HTTPException(status_code=401, detail="Unauthorized: X-AutoAlt-Key header is missing")
+        
+    # Block if the header value does not match your secret hash
+    if token != SECRET_KEY:
+        raise HTTPException(status_code=403, detail="Forbidden: Invalid X-AutoAlt-Key")
+        
+    return token
+
 app = FastAPI(title="Antigravity SEO Scaler API")
 
 app.add_middleware(
@@ -193,15 +209,8 @@ def run_scan_job(job_id: str, domain: str, limit: int, is_auto: bool = False):
 # --- Endpoints ---
 
 @app.get("/scrape")
-def run_scraper(x_autoalt_key: str = Header(None, alias="X-AutoAlt-Key")):
-    # Block if the header is missing
-    if not x_autoalt_key:
-        raise HTTPException(status_code=401, detail="Unauthorized: X-AutoAlt-Key header is missing")
-        
-    # Block if the header value does not match your secret hash
-    if x_autoalt_key != SECRET_KEY:
-        raise HTTPException(status_code=403, detail="Forbidden: Invalid X-AutoAlt-Key")
-        
+@app.get("/api/scrape")
+def run_scraper(auth: str = Depends(verify_key)):
     # If successful, return the scraped data
     return {"status": "success", "data": "Scraped data goes here"}
 
@@ -217,17 +226,20 @@ def health_check():
     return {"status": "alive"}
 
 @app.get("/api/status")
+@app.get("/status")
 def get_system_status(domain: Optional[str] = None):
     # If a domain is provided, we check its connectivity specifically
     stats = SystemMonitor.get_system_stats(target_url=domain)
     return stats
 
 @app.post("/api/scanstart")
+@app.post("/scanstart")
 def start_scan(
     bg: BackgroundTasks,
     payload: Optional[StartReq] = None,
     domain: Optional[str] = Query(None),
-    limit: Optional[int] = Query(25)
+    limit: Optional[int] = Query(25),
+    auth: str = Depends(verify_key)
 ):
     # Support both JSON body and query parameters
     if payload:
@@ -263,7 +275,9 @@ def start_scan(
 
 @app.get("/api/progress/{job_id}")
 @app.get("/api/progress")
-def scan_progress(job_id: Optional[str] = None):
+@app.get("/progress/{job_id}")
+@app.get("/progress")
+def scan_progress(job_id: Optional[str] = None, auth: str = Depends(verify_key)):
     if not job_id:
          return JSONResponse(status_code=400, content={"error": "job_id is required"})
     
@@ -299,7 +313,9 @@ def scan_progress(job_id: Optional[str] = None):
 
 @app.get("/api/result/{job_id}")
 @app.get("/api/result")
-def scan_result(job_id: Optional[str] = None):
+@app.get("/result/{job_id}")
+@app.get("/result")
+def scan_result(job_id: Optional[str] = None, auth: str = Depends(verify_key)):
     if not job_id:
          return JSONResponse(status_code=400, content={"error": "job_id is required"})
          
@@ -313,21 +329,18 @@ def scan_result(job_id: Optional[str] = None):
     return job["result"]
 
 # Legacy Endpoint Support (Optional - redirects to a sync wait or error?)
-# For now, let's keep it but make it use the new logic synchronously if possible, 
-# OR just deprecate it. Given the request, we should probably stick to the new API.
-# But for backward compatibility with existing frontend using /api/seo-report?
-# The user didn't ask to remove it, but the new code replaces the structure.
-# I'll enable a blocking legacy endpoint for safety.
-
 @app.get("/api/seo-report")
+@app.get("/seo-report")
 def get_seo_report_legacy_get(
     domain: Optional[str] = Query(None), 
-    limit: Optional[int] = Query(25)
+    limit: Optional[int] = Query(25),
+    auth: str = Depends(verify_key)
 ):
     return handle_legacy_request(domain, limit)
 
 @app.post("/api/seo-report")
-def get_seo_report_legacy_post(payload: StartReq):
+@app.post("/seo-report")
+def get_seo_report_legacy_post(payload: StartReq, auth: str = Depends(verify_key)):
     return handle_legacy_request(payload.domain, payload.limit)
 
 def handle_legacy_request(domain: Optional[str], limit: int):

app.py

@@ -1,23 +1,27 @@
 import os
 from fastapi import FastAPI, Header, HTTPException
 
-app = FastAPI()
-
 # Securely load the key from Hugging Face environment variables
 SECRET_KEY = os.getenv("AUTOALT_SECRET_KEY")
 
-@app.get("/scrape")
-def run_scraper(x_autoalt_key: str = Header(None, alias="X-AutoAlt-Key")):
-    # Block if the header is missing
-    if not x_autoalt_key:
-        raise HTTPException(status_code=401, detail="Unauthorized: X-AutoAlt-Key header is missing")
-        
-    # Block if the header value does not match your secret hash
-    if x_autoalt_key != SECRET_KEY:
-        raise HTTPException(status_code=403, detail="Forbidden: Invalid X-AutoAlt-Key")
-        
-    # If successful, return the scraped data
-    return {"status": "success", "data": "Scraped data goes here"}
+try:
+    from api import app, verify_key, run_scraper
+except ImportError:
+    app = FastAPI()
+
+    @app.get("/scrape")
+    @app.get("/api/scrape")
+    def run_scraper(x_autoalt_key: str = Header(None, alias="X-AutoAlt-Key")):
+        # Block if the header is missing
+        if not x_autoalt_key:
+            raise HTTPException(status_code=401, detail="Unauthorized: X-AutoAlt-Key header is missing")
+            
+        # Block if the header value does not match your secret hash
+        if x_autoalt_key != SECRET_KEY:
+            raise HTTPException(status_code=403, detail="Forbidden: Invalid X-AutoAlt-Key")
+            
+        # If successful, return the scraped data
+        return {"status": "success", "data": "Scraped data goes here"}
 
 if __name__ == "__main__":
     import uvicorn

static/index.html

@@ -216,6 +216,9 @@
         </header>
 
         <div class="card">
+            <div class="input-group" style="margin-bottom: 0.75rem;">
+                <input type="password" id="apiKeyInput" placeholder="Enter X-AutoAlt-Key (API Key)" style="width: 100%;">
+            </div>
             <div class="input-group">
                 <input type="text" id="domainInput" placeholder="Enter Domain (e.g. https://example.com)"
                     value="https://example.com">
@@ -265,6 +268,17 @@
         let jobId = null;
         let pollInterval = null;
 
+        function getAuthHeaders(extraHeaders = {}) {
+            const headers = { ...extraHeaders };
+            const apiKeyInput = document.getElementById('apiKeyInput');
+            const apiKey = apiKeyInput ? apiKeyInput.value.trim() : '';
+            if (apiKey) {
+                headers['X-AutoAlt-Key'] = apiKey;
+                try { localStorage.setItem('autoalt_key', apiKey); } catch (e) {}
+            }
+            return headers;
+        }
+
         async function startScan() {
             const domain = document.getElementById('domainInput').value;
             const limit = parseInt(document.getElementById('limitInput').value);
@@ -280,9 +294,19 @@
                 // 1. Start Job
                 const res = await fetch('/api/scanstart', {
                     method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
+                    headers: getAuthHeaders({ 'Content-Type': 'application/json' }),
                     body: JSON.stringify({ domain, limit })
                 });
+
+                if (!res.ok) {
+                    const err = await res.json().catch(() => ({}));
+                    const msg = err.detail || err.error || ('HTTP ' + res.status);
+                    alert("Scan start failed: " + msg);
+                    document.getElementById('scanBtn').disabled = false;
+                    document.getElementById('progress-section').style.display = 'none';
+                    return;
+                }
+
                 const data = await res.json();
                 jobId = data.job_id;
 
@@ -292,6 +316,7 @@
             } catch (e) {
                 alert("Error starting scan: " + e);
                 document.getElementById('scanBtn').disabled = false;
+                document.getElementById('progress-section').style.display = 'none';
             }
         }
 
@@ -299,7 +324,9 @@
             if (!jobId) return;
 
             try {
-                const res = await fetch(`/api/progress/${jobId}`);
+                const res = await fetch(`/api/progress/${jobId}`, {
+                    headers: getAuthHeaders()
+                });
                 const data = await res.json();
 
                 // Update UI
@@ -329,16 +356,30 @@
         }
 
         async function fetchResult() {
-            const res = await fetch(`/api/result/${jobId}`);
+            const res = await fetch(`/api/result/${jobId}`, {
+                headers: getAuthHeaders()
+            });
             const data = await res.json();
 
             document.getElementById('result-section').style.display = 'block';
             document.getElementById('json-output').innerText = JSON.stringify(data, null, 2);
         }
 
-        // Auto-fill from query params
+        // Auto-fill from query params or localStorage
         window.onload = () => {
+            try {
+                const savedKey = localStorage.getItem('autoalt_key');
+                if (savedKey && document.getElementById('apiKeyInput')) {
+                    document.getElementById('apiKeyInput').value = savedKey;
+                }
+            } catch (e) {}
+
             const urlParams = new URLSearchParams(window.location.search);
+            const keyParam = urlParams.get('key') || urlParams.get('x_autoalt_key');
+            if (keyParam && document.getElementById('apiKeyInput')) {
+                document.getElementById('apiKeyInput').value = keyParam;
+            }
+
             const domain = urlParams.get('domain');
             const limit = urlParams.get('limit');
 
@@ -346,7 +387,7 @@
                 document.getElementById('domainInput').value = domain;
                 if (limit) document.getElementById('limitInput').value = limit;
 
-                // Auto start
+                // Auto start if key is also available
                 startScan();
             }
         }