feat(web): hashed API credential registry for request-time auth

[cursor]

What

Request-time SaaS authentication reads a stdlib SQLite registry (credential_registry.py, table api_credentials) instead of os.getenv("CODEC_CARVER_API_KEYS").

• Bootstrap transport: pass an explicit mapping into bootstrap_from_mapping at process start (FastAPI lifespan). The env var is not read inside request handlers.
• Stored material is a SHA-256 digest of the UTF-8 key, plus lifecycle (active / rotated / revoked) and optional expiry. Callers pass now.
• Verification compares every active digest with hmac.compare_digest so first-match timing is not a signal and mixed str/bytes cannot raise TypeError on hostile Unicode.
• GET /health returns {"status":"ok","service":"codec-carver"} and stays auth-exempt so probes can confirm the process is up.
• Decision record: docs/doctoring/api-credential-registry.md (APA 7: NIST SP 800-63B, RFC 2104, OWASP API Security Top 10 2023).

Why

Issues #329 and #373. AGENTS.md forbids request-time env secrets. This is the next buyer-visible gap after the Cloud Agent environment work.

Validation

• python3 -m unittest tests.test_credential_registry tests.test_saas_web -v — 108 passed
• python3 -m coverage report --include=credential_registry.py,saas_web.py — 100%
• python3 -m interrogate credential_registry.py saas_web.py — 100%
• python3 -m py_compile credential_registry.py saas_web.py — OK

Notes

• Prefer fix(env): fail-closed Cloud Agent start and hash-locked install #427 as the Cloud Agent environment landing vehicle. Do not merge Add Cloud Agent dev environment config #426 at 8a60d4a.
• Do not mix drop-zone work (fix(ui): overlay landmarks and click-or-drag copy on drop zones #428) or jobs → conversion_jobs into this PR.
• HMAC-only sentinels 🛡️ Sentinel: [HIGH] API 인증 시 hmac.compare_digest TypeError로 인한 DoS 취약점 수정 #376 and 🛡️ Sentinel: [CRITICAL] hmac.compare_digest 유니코드 DoS 취약점 수정 #421 are superseded for the auth path once this lands; do not merge them in parallel.
• Production fail-closed bind (non-loopback + empty registry) is the next slice.
• Do not self-approve.

  

[cursor]

This is the credential-registry landing vehicle for #329/#373. Head d3f0280 moves request-time auth off os.getenv("CODEC_CARVER_API_KEYS") onto hashed api_credentials.

Next actions:

• Keep #427 as the Cloud Agent environment head. Do not merge #426 at 8a60d4a.
• After #427 is the named env tip, rebase this PR onto it. Both add GET /health and ARCHITECTURE.md.
• Do not merge HMAC-only #376/#421 in parallel; this PR covers the Unicode compare_digest path.
• Do not mix drop-zone (#428) or jobs → conversion_jobs here.
• Do not self-approve. Wait for required checks on this head.

View PR

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Useful first slice (hashed api_credentials, lifespan bootstrap, auth-exempt GET /health), but do not land this in parallel with #430.

#430 already covers the #373 gaps this body deferred: fail-closed 0.0.0.0 without keys, credential_events audit, and public listings that omit digests. Merging both will conflict on the registry API.

Do this next:

1. Prefer #430 (5a80b18) as the credential landing vehicle. Close or supersede this draft after that head is named.
2. Keep verify → credential_id as the idea to port onto #430 so usage metering can drop plaintext api_key.
3. Do not mix drop-zone (#428) or Cloud Agent env (#426/#427) into this branch.
4. Do not self-approve.

View PR

  

_{Sent by Cursor Automation: Fix Issues}

[seonghobae]

Closing as superseded by #430. The current #430 lineage explicitly ports the remaining #429 ideas—FastAPI lifespan bootstrap and verify returning the stable credential_id—onto the stronger credential-registry design. #430 also adds the missing production boundaries: public-bind fail-closed behavior, explicit loopback development mode, credential lifecycle/event tables, runtime policies, rotation/revoke semantics, and no-store 401s. No unique product behavior remains here, and the two SQLite registry implementations must not compete for credential_registry.py / saas_web.py. No checks or reviews from this closed PR transfer to #430.