excel file update

app/infrastructure/security.py

@@ -186,6 +186,40 @@ def password_hash_fingerprint(encoded: str) -> str:
     return hashlib.sha256(encoded.strip().strip("'\"").encode("utf-8")).hexdigest()[:12]
 
 
+def api_key_fingerprint(name: str, secret: str) -> str:
+    """
+    A short, non-reversible identifier for a configured API key.
+
+    Same purpose as password_hash_fingerprint - say *which* credential is loaded
+    without moving the credential - but the safety argument is different and
+    worth stating. That function digests an encoded hash which already embeds a
+    16-byte random salt. An API key has no salt, so the name is mixed in here to
+    keep two consumers that were mistakenly issued the same secret from
+    fingerprinting identically, and settings._parse_api_keys enforces a minimum
+    secret length so the digest cannot be walked back with a wordlist.
+    """
+    if not secret:
+        return ""
+    cleaned = secret.strip().strip("'\"")
+    material = f"{name}:{cleaned}"
+    return hashlib.sha256(material.encode("utf-8")).hexdigest()[:12]
+
+
+def describe_api_keys() -> List[Dict[str, object]]:
+    """Every configured key as {name, role, fingerprint}, sorted by name.
+
+    Sorted so two deployments' /api/health output can be diffed line for line;
+    API_KEYS is keyed by secret, whose iteration order says nothing useful.
+    """
+    return sorted(
+        (
+            {"name": name, "role": role, "fingerprint": api_key_fingerprint(name, secret)}
+            for secret, (name, role) in API_KEYS.items()
+        ),
+        key=lambda entry: entry["name"],
+    )
+
+
 def describe_password_hash(encoded: str) -> Dict[str, object]:
     """A loggable/publishable summary of a configured digest. Never its bytes."""
     parsed = _parse_encoded_hash(encoded)
@@ -211,6 +245,13 @@ def auth_config_summary() -> Dict[str, object]:
     means the container's own environment supplied it and the .env file baked
     into the image was ignored - which is invisible from anywhere else, and is
     precisely how a corrected credential can keep failing after a redeploy.
+
+    The same argument is why the API keys are summarised here. backend/Dockerfile
+    copies .env.production in at BUILD time, so a key added to that file and then
+    merely restarted is not present in the running process - and from outside,
+    an undeployed key is indistinguishable from a wrong one, because both are
+    just a 401. Publishing the names and fingerprints answers "is my key on this
+    deployment?" without anyone having to send the secret to find out.
     """
     described = describe_password_hash(AUTH_ADMIN_PASSWORD_HASH)
     return {
@@ -222,6 +263,9 @@ def auth_config_summary() -> Dict[str, object]:
         "password_hash_fingerprint": described["fingerprint"],
         "admin_username_source": config_source("AUTH_ADMIN_USERNAME"),
         "password_hash_source": config_source("AUTH_ADMIN_PASSWORD_HASH"),
+        "api_keys_count": len(API_KEYS),
+        "api_keys": describe_api_keys(),
+        "api_keys_source": config_source("API_KEYS"),
     }