excel file update

app/infrastructure/settings.py

@@ -386,6 +386,12 @@ AUTH_LOCKOUT_SECONDS = int(os.getenv("AUTH_LOCKOUT_SECONDS", "300"))
 AUTH_ALLOW_ANY_LOGIN = _bool("AUTH_ALLOW_ANY_LOGIN", "false")
 
 
+# Shortest acceptable API key secret. token_urlsafe(32) yields 43 characters, so
+# this rejects hand-typed values without rejecting anything the documented
+# generator produces.
+API_KEY_MIN_LENGTH = 32
+
+
 def _parse_api_keys(raw: str) -> dict:
     """
     Parse ``API_KEYS`` - ``name:role:secret`` triples, comma-separated.
@@ -393,6 +399,16 @@ def _parse_api_keys(raw: str) -> dict:
     Keyed by secret because that is what an inbound request presents. One entry
     per consumer is the point: a shared key cannot be revoked for one caller
     without breaking all of them.
+
+    Secrets must be at least API_KEY_MIN_LENGTH characters. That is not about
+    guessing the key over the network - the lockout and the network itself make
+    online brute force impractical - but about what /api/health publishes. It
+    reports a truncated digest of every configured key so a deployment can be
+    checked against the config it was built from, and a digest of a *raw* secret
+    is only safe when the secret is unguessable offline. An admin password hash
+    embeds a random salt, so its fingerprint discloses nothing; an API key has no
+    salt, and a hand-picked "changeme" would fall to a wordlist in seconds.
+    Generate one with: python -c "import secrets; print(secrets.token_urlsafe(32))"
     """
     parsed: dict = {}
     for entry in raw.split(","):
@@ -412,6 +428,13 @@ def _parse_api_keys(raw: str) -> dict:
             )
         if not secret:
             raise RuntimeError(f"API_KEYS entry {name!r} has an empty secret.")
+        if len(secret) < API_KEY_MIN_LENGTH:
+            raise RuntimeError(
+                f"API_KEYS entry {name!r} has a {len(secret)}-character secret; at least "
+                f"{API_KEY_MIN_LENGTH} are required, because /api/health publishes a digest "
+                f"of it. Generate one with: "
+                f"python -c \"import secrets; print(secrets.token_urlsafe(32))\""
+            )
         parsed[secret] = (name, role)
     return parsed