Upload folder using huggingface_hub

app/api/routes_admin.py

@@ -123,6 +123,46 @@ async def update_key_tier(
     return {"message": f"Tier updated to {req.tier}"}
 
 
+@router.post("/keys/{key_id}/rotate", dependencies=[Depends(verify_admin)])
+async def rotate_api_key(
+    key_id: str = Path(..., description="The key_id from GET /admin/keys (not the raw API key)"),
+):
+    """Atomically deactivate a key and issue a new one on the same tenant
+    and tier -- the single action a leaked/compromised key actually needs.
+    Doing this as get-old + deactivate + create separately (the only option
+    before this endpoint existed) risks losing track of the tenant_id
+    partway through, or leaving the old key active if a later step fails.
+    The new plaintext key is returned exactly once, like create_api_key's."""
+    with tracker._get_pg_conn() as conn:
+        old_row = tracker._pg_execute(
+            conn, "SELECT tenant_id, tier FROM api_keys WHERE lookup_hash = %s", (key_id,)
+        ).fetchone()
+        if not old_row:
+            conn.rollback()
+            raise HTTPException(status_code=404, detail="API key not found")
+
+        new_key = f"sk_live_{uuid.uuid4().hex[:24]}"
+        salt = secrets.token_hex(16)
+        tracker._pg_execute(
+            conn, "UPDATE api_keys SET is_active = false WHERE lookup_hash = %s", (key_id,))
+        tracker._pg_execute(
+            conn,
+            "INSERT INTO api_keys "
+            "(tenant_id, tier, created_at, is_active, salt, key_hash, lookup_hash) "
+            "VALUES (%s, %s, %s, %s, %s, %s, %s)",
+            (old_row["tenant_id"], old_row["tier"], datetime.utcnow(), True,
+             salt, tracker._salted_hash(new_key, salt), tracker._lookup_hash(new_key)),
+        )
+        conn.commit()
+
+    return {
+        "api_key": new_key,
+        "tenant_id": old_row["tenant_id"],
+        "tier": old_row["tier"],
+        "deactivated_key_id": key_id,
+    }
+
+
 @router.delete("/keys/{key_id}", dependencies=[Depends(verify_admin)])
 async def deactivate_api_key(
         key_id: str = Path(..., description="The key_id from GET /admin/keys (not the raw API key)")):

app/api/routes_governance.py

@@ -366,7 +366,7 @@ async def evaluate_intent_endpoint(
             span.set_status(Status(StatusCode.ERROR, error_msg))
             span.record_exception(e)
             span.end()
-        raise HTTPException(status_code=500, detail=error_msg)
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 # --------------------------------------------------------------------------
@@ -413,8 +413,9 @@ async def record_outcome_endpoint(
                 logger.warning(f"Failed to update pricing buffer for intent {outcome.deterministic_id}: {e}")
 
         return {"message": "Outcome recorded", "outcome_id": outcome_record.id}
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=str(e))
+    except Exception:
+        logger.exception("Error recording outcome")
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 # --------------------------------------------------------------------------
@@ -553,4 +554,4 @@ async def evaluate_healing_decision_endpoint(
             span.set_status(Status(StatusCode.ERROR, error_msg))
             span.record_exception(e)
             span.end()
-        raise HTTPException(status_code=500, detail=error_msg)
+        raise HTTPException(status_code=500, detail="Internal server error")

app/api/routes_history.py

@@ -7,4 +7,4 @@ router = APIRouter(dependencies=[Depends(verify_internal_key)])
 
 @router.get("/history")
 async def get_history():
-    return {"incidents": incident_history}
+    return {"incidents": list(incident_history)}

app/api/routes_incidents.py

@@ -30,23 +30,20 @@ from agentic_reliability_framework.core.models.event import (
     ReliabilityEvent,
 )
 
+from app.api.deps import verify_internal_key
 from app.causal_explainer import CausalExplainer
+from app.core.storage import incident_history
 from app.core.usage_tracker import UsageRecord, enforce_quota, tracker
 
 logger = logging.getLogger(__name__)
 
 router = APIRouter()
 
-# ---------------------------------------------------------------------------
-# In‑memory incident store  (for auditing / debugging only)
-# ---------------------------------------------------------------------------
-incident_history: list[dict] = []
-
 
 # ---------------------------------------------------------------------------
 # POST /api/v1/report_incident
 # ---------------------------------------------------------------------------
-@router.post("/report_incident")
+@router.post("/report_incident", dependencies=[Depends(verify_internal_key)])
 async def report_incident(event: ReliabilityEvent) -> dict[str, str]:
     """
     Record a ``ReliabilityEvent`` in the in‑memory incident history.
@@ -54,7 +51,10 @@ async def report_incident(event: ReliabilityEvent) -> dict[str, str]:
     This endpoint is used by internal monitoring tools to feed incident
     data into the causal explainer and downstream analysis.  The event
     is stored as a JSON‑safe dictionary and is **not** persisted across
-    API restarts.
+    API restarts. Requires the same ``X-Internal-Key`` header every other
+    data-bearing route in this API requires -- previously this endpoint had
+    no auth dependency at all, so anyone could write into the incident
+    history that feeds the causal explainer and ``GET /history``.
 
     Parameters
     ----------
@@ -249,6 +249,7 @@ async def evaluate_incident(
         raise
     except Exception as exc:
         error_msg = str(exc)
+        logger.exception("Error in evaluate_incident (deprecated endpoint)")
         if tracker:
             record = UsageRecord(
                 api_key=api_key,
@@ -260,4 +261,4 @@ async def evaluate_incident(
                 processing_ms=(time.time() - start_time) * 1000,
             )
             await tracker.increment_usage_async(record, background_tasks)
-        raise HTTPException(status_code=500, detail=error_msg)
+        raise HTTPException(status_code=500, detail="Internal server error")

app/api/routes_intents.py

@@ -1,8 +1,12 @@
+import logging
+
 from fastapi import APIRouter, Depends, HTTPException
 from app.api.deps import verify_internal_key
 from app.models.intent_models import IntentSimulation, IntentSimulationResponse
 from app.services.intent_service import simulate_intent
 
+logger = logging.getLogger(__name__)
+
 router = APIRouter(dependencies=[Depends(verify_internal_key)])
 
 
@@ -11,5 +15,6 @@ async def simulate_intent_endpoint(intent: IntentSimulation):
     try:
         result = simulate_intent(intent)
         return IntentSimulationResponse(**result)
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=str(e))
+    except Exception:
+        logger.exception("simulate_intent failed")
+        raise HTTPException(status_code=500, detail="Internal server error")

app/api/routes_payments.py

@@ -2,6 +2,7 @@
 Payment endpoints – Stripe Checkout integration.
 """
 
+import logging
 import os
 import stripe
 from fastapi import APIRouter, HTTPException
@@ -9,6 +10,8 @@ from pydantic import BaseModel
 
 from app.core.usage_tracker import tracker, Tier
 
+logger = logging.getLogger(__name__)
+
 router = APIRouter(prefix="/payments", tags=["payments"])
 
 # Set Stripe API key (from environment)
@@ -59,5 +62,6 @@ async def create_checkout_session(req: CheckoutRequest):
             subscription_data={"metadata": {"api_key": req.api_key}},
         )
         return {"sessionId": checkout_session.id, "url": checkout_session.url}
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=str(e))
+    except Exception:
+        logger.exception("create_checkout_session failed")
+        raise HTTPException(status_code=500, detail="Internal server error")

app/api/routes_risk.py

@@ -1,8 +1,12 @@
+import logging
+
 from fastapi import APIRouter, Depends, HTTPException
 from app.api.deps import verify_internal_key
 from app.models.risk_models import RiskResponse
 from app.services.risk_service import get_system_risk
 
+logger = logging.getLogger(__name__)
+
 router = APIRouter(dependencies=[Depends(verify_internal_key)])
 
 
@@ -14,8 +18,9 @@ async def get_risk():
         raise HTTPException(
             status_code=501,
             detail="This endpoint is deprecated and not implemented")
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=str(e))
+    except Exception:
+        logger.exception("get_risk failed")
+        raise HTTPException(status_code=500, detail="Internal server error")
 
     if risk < 0.3:
         status = "low"

app/core/storage.py

@@ -1,2 +1,16 @@
-# Simple in-memory list for incident history
-incident_history = []
+"""In-memory store for recent incident reports.
+
+Bounded (maxlen), not persisted across restarts -- exists to give the
+causal explainer and GET /history recent context, not as a durable audit
+trail. The cap protects against unbounded memory growth from
+POST /report_incident, which can be called repeatedly by anything holding
+a valid internal key.
+
+Shared by app.api.routes_incidents (writes, via report_incident) and
+app.api.routes_history (reads, via GET /history) -- both must import this
+same object rather than declaring their own list, or writes and reads
+silently operate on two different lists.
+"""
+from collections import deque
+
+incident_history: deque = deque(maxlen=10_000)

app/main.py

@@ -35,8 +35,9 @@ import time as _time
 from contextlib import asynccontextmanager
 from typing import Dict
 
-from fastapi import FastAPI
+from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import JSONResponse
 
 # ── Optional: Prometheus metrics ─────────────────────────────
 try:
@@ -371,6 +372,19 @@ def create_app() -> FastAPI:
     )
     logger.debug("CORS middleware configured")
 
+    # ── Generic exception handler ────────────────────────────
+    # Defense-in-depth for anything that escapes a route's own try/except
+    # uncaught (HTTPException instances are unaffected -- FastAPI's own,
+    # more specific handler for those still takes precedence). Logs the
+    # real exception server-side and returns a generic message: routes
+    # that catch their own exceptions have each been fixed to do the same,
+    # but this exists so a bug that skips that pattern doesn't leak raw
+    # exception text (paths, internals, third-party SDK details) to callers.
+    @app.exception_handler(Exception)
+    async def unhandled_exception_handler(request: Request, exc: Exception):
+        logger.exception("Unhandled exception on %s %s", request.method, request.url.path)
+        return JSONResponse(status_code=500, content={"detail": "Internal server error"})
+
     # ── Rate limiter ──────────────────────────────────────────
     if SLOWAPI_AVAILABLE:
         app.state.limiter = limiter

tests/test_routes_admin.py

@@ -81,3 +81,37 @@ def test_update_nonexistent_key_returns_404(client):
         json={"tier": "pro"},
     )
     assert resp.status_code == 404
+
+
+def test_rotate_key_deactivates_old_and_creates_new_on_same_tenant(client):
+    create_resp = client.post(
+        "/admin/keys",
+        params={"admin_key": TEST_ADMIN_KEY},
+        json={"tier": "pro", "org_name": "Rotate Test Org"},
+    )
+    assert create_resp.status_code == 200
+    old_body = create_resp.json()
+    old_key_id = _key_id(old_body["api_key"])
+    tenant_id = old_body["tenant_id"]
+
+    rotate_resp = client.post(
+        f"/admin/keys/{old_key_id}/rotate", params={"admin_key": TEST_ADMIN_KEY})
+    assert rotate_resp.status_code == 200
+    rotated = rotate_resp.json()
+    assert rotated["tenant_id"] == tenant_id
+    assert rotated["tier"] == "pro"
+    assert rotated["deactivated_key_id"] == old_key_id
+    new_key_id = _key_id(rotated["api_key"])
+    assert new_key_id != old_key_id
+
+    list_resp = client.get("/admin/keys", params={"admin_key": TEST_ADMIN_KEY})
+    keys_by_id = {row["key_id"]: row for row in list_resp.json()["keys"]}
+    assert keys_by_id[old_key_id]["is_active"] is False
+    assert keys_by_id[new_key_id]["is_active"] is True
+    assert keys_by_id[new_key_id]["tier"] == "pro"
+
+
+def test_rotate_nonexistent_key_returns_404(client):
+    resp = client.post(
+        "/admin/keys/does-not-exist/rotate", params={"admin_key": TEST_ADMIN_KEY})
+    assert resp.status_code == 404