Upload folder using huggingface_hub

app/api/routes_payments.py

@@ -5,11 +5,11 @@ Payment endpoints – Stripe Checkout integration.
 import logging
 import os
 import stripe
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, Depends, HTTPException
 from pydantic import BaseModel
 
 from app.core import usage_tracker
-from app.core.usage_tracker import Tier
+from app.core.usage_tracker import Tier, resolve_api_key_identity
 
 logger = logging.getLogger(__name__)
 
@@ -21,23 +21,34 @@ STRIPE_WEBHOOK_SECRET = os.getenv("STRIPE_WEBHOOK_SECRET")
 
 
 class CheckoutRequest(BaseModel):
-    api_key: str
-
     success_url: str
     cancel_url: str
 
 
 @router.post("/create-checkout-session")
-async def create_checkout_session(req: CheckoutRequest):
-    """Create a Stripe Checkout session for the Pro tier."""
+async def create_checkout_session(
+    req: CheckoutRequest,
+    identity: dict = Depends(resolve_api_key_identity),
+):
+    """Create a Stripe Checkout session for the Pro tier.
+
+    Identity comes from `resolve_api_key_identity` (Authorization: Bearer
+    header, same pepper-HMAC lookup every other authenticated endpoint
+    uses) rather than from a caller-supplied field in the request body --
+    previously this endpoint took `api_key` as a JSON field with no
+    `Depends()` gate at all, so nothing distinguished "the caller proved
+    they hold this key" from "the caller typed this string into a
+    request." `enforce_quota` is deliberately not used here: a FREE-tier
+    caller who has exhausted their monthly quota must still be able to
+    reach this endpoint, since upgrading is often exactly what they are
+    trying to do.
+    """
     if not stripe.api_key:
         raise HTTPException(status_code=500, detail="Stripe not configured")
     if not usage_tracker.tracker:
         raise HTTPException(status_code=503, detail="Usage tracking service not initialised")
 
-    # Verify the API key exists and is free tier
-    tier = usage_tracker.tracker.get_tier(req.api_key)
-    if tier != Tier.FREE:
+    if identity["tier"] != Tier.FREE:
         raise HTTPException(status_code=400,
                             detail="Only free tier keys can be upgraded")
 
@@ -48,7 +59,7 @@ async def create_checkout_session(req: CheckoutRequest):
     # third party with no reason to ever see it. tenant_id is an opaque,
     # non-secret row identifier and is exactly what the webhook needs to
     # look up which tenant's keys to retier.
-    tenant_id = usage_tracker.tracker.get_tenant_id(req.api_key)
+    tenant_id = identity["tenant_id"]
 
     try:
         checkout_session = stripe.checkout.Session.create(

app/core/usage_tracker.py

@@ -660,20 +660,30 @@ def update_key_tier_by_tenant_id(tenant_id: str, new_tier: Tier) -> bool:
     return tracker.update_tier_by_tenant_id(tenant_id, new_tier)
 
 
-async def enforce_quota(request: Request, api_key: str = None):
+def _extract_api_key(request: Request, api_key: str = None) -> str:
+    if api_key:
+        return api_key
+    auth_header = request.headers.get("Authorization")
+    if auth_header and auth_header.startswith("Bearer "):
+        return auth_header[7:]
+    return request.query_params.get("api_key")
+
+
+async def resolve_api_key_identity(request: Request, api_key: str = None):
     """
-    FastAPI dependency that enforces quota and attaches tenant_id to request state.
+    FastAPI dependency that authenticates an API key and attaches tenant_id
+    to request state, without enforcing monthly quota.
+
+    Deliberately separate from `enforce_quota`: a caller whose quota is
+    already exhausted must still be able to reach an endpoint like
+    `/payments/create-checkout-session` (upgrading tier is often exactly
+    what a rate-limited caller is trying to do) -- gating that path behind
+    `enforce_quota` would 429 the one action that lets them fix it.
     """
     if tracker is None:
         raise HTTPException(status_code=503, detail="Usage tracking service not initialised.")
 
-    if api_key is None:
-        auth_header = request.headers.get("Authorization")
-        if auth_header and auth_header.startswith("Bearer "):
-            api_key = auth_header[7:]
-        else:
-            api_key = request.query_params.get("api_key")
-
+    api_key = _extract_api_key(request, api_key)
     if not api_key:
         raise HTTPException(status_code=401, detail="Missing API key")
 
@@ -681,11 +691,6 @@ async def enforce_quota(request: Request, api_key: str = None):
     if tier is None:
         raise HTTPException(status_code=403, detail="Invalid or inactive API key")
 
-    remaining = tracker.get_remaining_quota(api_key, tier)
-    if remaining is not None and remaining <= 0:
-        raise HTTPException(status_code=429, detail="Monthly evaluation quota exceeded")
-
-    # Retrieve tenant_id
     tenant_id = tracker.get_tenant_id(api_key)
     if not tenant_id:
         raise HTTPException(status_code=403, detail="API key not associated with a tenant")
@@ -694,4 +699,18 @@ async def enforce_quota(request: Request, api_key: str = None):
     request.state.tier = tier
     request.state.tenant_id = tenant_id
 
+    return {"api_key": api_key, "tier": tier, "tenant_id": tenant_id}
+
+
+async def enforce_quota(request: Request, api_key: str = None):
+    """
+    FastAPI dependency that enforces quota and attaches tenant_id to request state.
+    """
+    identity = await resolve_api_key_identity(request, api_key)
+    api_key, tier, tenant_id = identity["api_key"], identity["tier"], identity["tenant_id"]
+
+    remaining = tracker.get_remaining_quota(api_key, tier)
+    if remaining is not None and remaining <= 0:
+        raise HTTPException(status_code=429, detail="Monthly evaluation quota exceeded")
+
     return {"api_key": api_key, "tier": tier, "tenant_id": tenant_id, "remaining": remaining}

tests/conftest.py

@@ -46,6 +46,9 @@ class MockTracker:
 
         return 1000
 
+    def get_tenant_id(self, api_key):
+        return "test-tenant"
+
     def consume_quota_and_log(self, record, idempotency_key=None):
 
         return (True, None)

tests/test_payments.py

@@ -28,8 +28,8 @@ def test_create_checkout_session_missing_stripe_key(monkeypatch):
     monkeypatch.setattr("stripe.api_key", None)
     response = client.post(
         "/api/v1/payments/create-checkout-session",
+        headers={"Authorization": "Bearer test_key"},
         json={
-            "api_key": "test_key",
             "success_url": "https://example.com/success",
             "cancel_url": "https://example.com/cancel"})
     assert response.status_code == 500
@@ -45,8 +45,8 @@ def test_create_checkout_session_free_key(mock_stripe):
             id="cs_test_123", url="https://checkout.stripe.com/pay")
         response = client.post(
             "/api/v1/payments/create-checkout-session",
+            headers={"Authorization": "Bearer test_key"},
             json={
-                "api_key": "test_key",
                 "success_url": "https://example.com/success",
                 "cancel_url": "https://example.com/cancel"})
         assert response.status_code == 200
@@ -60,10 +60,39 @@ def test_create_checkout_session_pro_key():
         mock_tracker.get_tier.return_value = "pro"
         response = client.post(
             "/api/v1/payments/create-checkout-session",
+            headers={"Authorization": "Bearer test_key"},
             json={
-                "api_key": "test_key",
                 "success_url": "https://example.com/success",
                 "cancel_url": "https://example.com/cancel"})
         assert response.status_code == 400
         assert "Only free tier keys can be upgraded" in response.json()[
             "detail"]
+
+
+def test_create_checkout_session_requires_authentication(mock_stripe):
+    # Regression test: this endpoint used to take `api_key` as a plain JSON
+    # body field with no Depends() gate at all, so any caller could request
+    # a session for any tenant_id-bearing key string without proving they
+    # held it. No Authorization header (and no api_key in the body -- the
+    # field no longer exists on CheckoutRequest) must be rejected before
+    # ever reaching Stripe.
+    response = client.post(
+        "/api/v1/payments/create-checkout-session",
+        json={
+            "success_url": "https://example.com/success",
+            "cancel_url": "https://example.com/cancel"})
+    assert response.status_code == 401
+    mock_stripe.assert_not_called()
+
+
+def test_create_checkout_session_rejects_invalid_key(mock_stripe):
+    with patch("app.core.usage_tracker.tracker") as mock_tracker:
+        mock_tracker.get_tier.return_value = None
+        response = client.post(
+            "/api/v1/payments/create-checkout-session",
+            headers={"Authorization": "Bearer not-a-real-key"},
+            json={
+                "success_url": "https://example.com/success",
+                "cancel_url": "https://example.com/cancel"})
+        assert response.status_code == 403
+        mock_stripe.assert_not_called()