# Security hardening: CSP, session revocation, and login fixes

app/api/v1/routes/auth.py

@@ -287,6 +287,18 @@ def _extract_bearer(authorization: Optional[str]) -> Optional[str]:
     return token.strip()
 
 
+def _revoke_local_password_access_token(bearer: str) -> None:
+    try:
+        claims = decode_access_token(bearer)
+        jti = claims.get("jti")
+        exp = claims.get("exp")
+        if jti and exp:
+            ttl = max(int(exp) - int(datetime.now(timezone.utc).timestamp()), 1)
+            revoke_access_jti(jti, ttl)
+    except JWTError:
+        pass
+
+
 def _issue_session_tokens(
     db: Session,
     *,
@@ -611,15 +623,7 @@ def logout(
     """Revoke the current session's refresh token and blacklist the access token."""
     bearer = _extract_bearer(authorization)
     if bearer and principal.auth_method == AuthMethod.LOCAL_PASSWORD:
-        try:
-            claims = decode_access_token(bearer)
-            jti = claims.get("jti")
-            exp = claims.get("exp")
-            if jti and exp:
-                ttl = max(int(exp) - int(datetime.now(timezone.utc).timestamp()), 1)
-                revoke_access_jti(jti, ttl)
-        except JWTError:
-            pass
+        _revoke_local_password_access_token(bearer)
 
     if payload and payload.refresh_token:
         revoke_refresh_token(db, payload.refresh_token)
@@ -697,12 +701,14 @@ def refresh_session(payload: RefreshRequest, db: Session = Depends(get_db)) -> T
 
 class SwitchOrgRequest(BaseModel):
     organization_id: str
+    refresh_token: Optional[str] = None
 
 
 @router.post("/switch-org", response_model=TokenResponse)
 def switch_organization(
     payload: SwitchOrgRequest,
     principal: Principal = Depends(get_principal),
+    authorization: Optional[str] = Header(None, alias="Authorization"),
     db: Session = Depends(get_db),
 ) -> TokenResponse:
     """
@@ -766,6 +772,13 @@ def switch_organization(
             detail="User is no longer active.",
         )
 
+    if principal.auth_method == AuthMethod.LOCAL_PASSWORD:
+        bearer = _extract_bearer(authorization)
+        if bearer:
+            _revoke_local_password_access_token(bearer)
+        if payload.refresh_token:
+            revoke_refresh_token(db, payload.refresh_token)
+
     user.last_login_at = datetime.now(timezone.utc)
     db.commit()
     db.refresh(user)

app/api/v1/routes/platform_admin.py

@@ -6,7 +6,8 @@
 from typing import List, Optional
 from uuid import UUID
 
-from fastapi import APIRouter, Depends, HTTPException, Query, status
+from fastapi import APIRouter, Depends, Header, HTTPException, Query, status
+from jose import JWTError
 from pydantic import BaseModel, EmailStr, Field
 from sqlalchemy import func
 from sqlalchemy.orm import Session
@@ -16,6 +17,7 @@
     create_platform_access_token,
     get_platform_admin,
     platform_admin_feature_enabled,
+    revoke_platform_access_token,
 )
 from app.core.auth.refresh_tokens import revoke_all_user_refresh_tokens
 from app.core.password import hash_password, validate_password_strength, verify_password
@@ -184,6 +186,26 @@ def platform_me(
     return PlatformAdminSummary(id=str(principal.platform_admin_id), email=principal.email)
 
 
+def _extract_bearer(authorization: Optional[str]) -> Optional[str]:
+    if not authorization:
+        return None
+    scheme, _, token = authorization.partition(" ")
+    if scheme.lower() != "bearer" or not token.strip():
+        return None
+    return token.strip()
+
+
+@router.post("/auth/logout")
+def platform_logout(
+    authorization: Optional[str] = Header(None, alias="Authorization"),
+    principal: PlatformAdminPrincipal = Depends(get_platform_admin),
+) -> dict:
+    bearer = _extract_bearer(authorization)
+    if bearer:
+        revoke_platform_access_token(bearer)
+    return {"success": True, "admin_id": str(principal.platform_admin_id)}
+
+
 @router.get("/organizations", response_model=OrganizationListResponse)
 def list_organizations(
     offset: int = Query(0, ge=0),

app/config.py

@@ -125,9 +125,9 @@ class Settings(BaseSettings):
     FRONTEND_DIR: str = "./frontend/dist"
     FRONTEND_BASE_URL: str = ""
 
-    # Content Security Policy (Report-Only by default; set CSP_REPORT_ONLY=false to enforce)
+    # Content Security Policy (enforcing by default; set CSP_REPORT_ONLY=true for local report-only mode)
     CSP_ENABLED: bool = True
-    CSP_REPORT_ONLY: bool = True
+    CSP_REPORT_ONLY: bool = False
     CSP_POLICY: str = (
         "default-src 'self'; "
         "script-src 'self'; "
@@ -859,6 +859,15 @@ def _apply_llm_gateway_settings(gateway_cfg: dict, *, gateway_type: str) -> None
         if "trusted_ips" in operational_config:
             settings.OPERATIONAL_TRUSTED_IPS = operational_config["trusted_ips"]
 
+    if "security" in config_data:
+        security_config = config_data["security"]
+        if "csp_enabled" in security_config:
+            settings.CSP_ENABLED = bool(security_config["csp_enabled"])
+        if "csp_report_only" in security_config:
+            settings.CSP_REPORT_ONLY = bool(security_config["csp_report_only"])
+        if security_config.get("csp_policy"):
+            settings.CSP_POLICY = security_config["csp_policy"]
+
     if "flexprice" in config_data:
         flexprice_config = config_data["flexprice"]
         if "enabled" in flexprice_config:

app/core/auth/platform_admin.py

@@ -12,6 +12,7 @@
 from sqlalchemy.orm import Session
 
 from app.config import settings
+from app.core.auth.token_revocation import is_access_jti_revoked, revoke_access_jti
 from app.database import get_db
 from app.models.database import PlatformAdmin
 
@@ -58,6 +59,18 @@ def decode_platform_access_token(token: str) -> Dict[str, Any]:
     )
 
 
+def revoke_platform_access_token(token: str) -> None:
+    try:
+        claims = decode_platform_access_token(token)
+        jti = claims.get("jti")
+        exp = claims.get("exp")
+        if jti and exp:
+            ttl = max(int(exp) - int(datetime.now(timezone.utc).timestamp()), 1)
+            revoke_access_jti(jti, ttl)
+    except JWTError:
+        pass
+
+
 def _extract_bearer(authorization: Optional[str]) -> Optional[str]:
     if not authorization:
         return None
@@ -107,6 +120,13 @@ def get_platform_admin(
             detail="Invalid platform admin token scope.",
         )
 
+    jti = claims.get("jti")
+    if jti and is_access_jti_revoked(jti):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Token has been revoked.",
+        )
+
     try:
         admin_id = UUID(claims["sub"])
     except (KeyError, ValueError) as exc:

app/core/operational_access_middleware.py

@@ -1,19 +1,20 @@
-"""Restrict /metrics from the public internet (/health stays open for load balancers)."""
+"""Restrict /metrics from the public internet (/health stays open for load balancers).
+
+Not Spring Boot Actuator: this FastAPI app exposes /health (LB probes) and /metrics
+(Prometheus scrape). /metrics is gated by trusted IPs or OPERATIONAL_PUBLIC only.
+"""
 
 from __future__ import annotations
 
 import ipaddress
 import logging
 from typing import Iterable
 
-from fastapi import HTTPException
 from starlette.middleware.base import BaseHTTPMiddleware
 from starlette.requests import Request
 from starlette.responses import JSONResponse, Response
 
 from app.config import settings
-from app.core.auth.dependency import _resolve
-from app.database import SessionLocal
 
 logger = logging.getLogger(__name__)
 
@@ -75,22 +76,6 @@ def _resolved_trusted_ip(request: Request) -> str | None:
     return hops[-1]
 
 
-def _has_authenticated_caller(request: Request) -> bool:
-    db = SessionLocal()
-    try:
-        principal = _resolve(
-            request.headers.get("authorization"),
-            request.headers.get("x-api-key"),
-            request.headers.get("x-efficientai-api-key"),
-            db,
-        )
-        return principal is not None
-    except HTTPException:
-        return False
-    finally:
-        db.close()
-
-
 def is_operational_access_allowed(request: Request) -> bool:
     """Return True when the caller may access a protected operational endpoint."""
     if settings.OPERATIONAL_PUBLIC:
@@ -100,9 +85,6 @@ def is_operational_access_allowed(request: Request) -> bool:
     if resolved_ip and _ip_in_trusted(resolved_ip, settings.OPERATIONAL_TRUSTED_IPS):
         return True
 
-    if _has_authenticated_caller(request):
-        return True
-
     return False
 
 

config.docker.yml

@@ -5,7 +5,7 @@
 app:
   name: "EfficientAI Voice AI Evaluation Platform"
   version: "0.1.0"
-  debug: true
+  debug: false
   secret_key: "your-secret-key-here-change-in-production"
   frontend_base_url: "http://localhost:8000"
 
@@ -15,12 +15,17 @@ server:
   port: 8000
 
 # Operational endpoints (/metrics). /health is always open for load balancers.
+# Not Spring Boot Actuator — /metrics is IP-gated via trusted_ips below.
 # Add VPC CIDRs here if Prometheus scrapes /metrics from inside the VPC.
 operational:
   public: false
   trusted_ips:
     - "10.0.0.0/8"
 
+security:
+  csp_enabled: true
+  csp_report_only: false
+
 # Database Configuration (Docker service name)
 database:
   url: "postgresql://efficientai:password@db:5432/efficientai"
@@ -99,7 +104,7 @@ auth:
   local_password:
     # Lifetime of the Bearer tokens minted at POST /auth/login (in minutes).
     # Keep this short; clients re-authenticate silently.
-    token_ttl_minutes: 720  # 12 hours
+    token_ttl_minutes: 15
     # Turn this off in Cloud SaaS to block self-serve signup.
     allow_signup: true
 

config.yml.example

@@ -17,12 +17,20 @@ server:
   port: 8000
 
 # Operational endpoints (/metrics). /health is always open for ALB/kube probes.
+# This is FastAPI, not Spring Boot Actuator — scanners may flag /health or /metrics
+# under an "Actuator" template. /metrics is IP-gated; /health returns minimal status only.
 # Include VPC CIDRs in trusted_ips if Prometheus scrapes /metrics from inside the VPC.
 operational:
   public: false
   trusted_ips:
     - "10.0.0.0/8"
 
+# HTTP security headers (CSP, X-Frame-Options, etc.)
+security:
+  csp_enabled: true
+  csp_report_only: false   # false = enforcing Content-Security-Policy header (required for compliance scans)
+  # csp_policy: "default-src 'self'; ..."  # optional override
+
 # Database Configuration
 database:
   # Legacy single-DB mode: use one database (e.g. efficientai). Sharding off (default).

env.example

@@ -41,6 +41,10 @@ CORS_ORIGINS=["http://localhost:3000", "http://localhost:8000"]
 API_KEY_HEADER=X-API-Key
 RATE_LIMIT_PER_MINUTE=60
 
+# HTTP security headers (see config.yml.example security section)
+CSP_ENABLED=true
+CSP_REPORT_ONLY=false
+
 # -----------------------------------------------------------------------------
 # Authentication (pluggable auth providers)
 # -----------------------------------------------------------------------------