new file: .env.example/.env.example

	new file:   .github/workflows/ci.yml
	new file:   .gitignore
	new file:   Dockerfile/Dockerfile
	modified:   README.md
	new file:   app/config.py
	new file:   app/db.py
	new file:   app/init.py
	new file:   app/main.py
	new file:   app/models.py
	new file:   app/routes_auth.py
	new file:   app/routes_notes.py
	new file:   app/schemas.py
	new file:   app/security.py
	new file:   docker-compose.yml
	new file:   pyproject.toml
	new file:   tests/test_auth_and_notes.py

Author: DCMedic

.env.example/.env.example

@@ -0,0 +1,9 @@
+APP_ENV=dev
+JWT_SECRET=change-me-to-a-long-random-secret
+JWT_EXPIRE_MINUTES=30
+FERNET_KEY=change-me-generate-with-python-fernet
+CORS_ORIGINS=http://localhost:3000
+
+# To generate a Fernet key:
+
+python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"

.github/workflows/ci.yml

@@ -0,0 +1,18 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - run: python -m pip install --upgrade pip
+      - run: pip install -e ".[dev]"
+      - run: ruff check app tests
+      - run: pytest

.gitignore

@@ -0,0 +1,8 @@
+.venv/
+__pycache__/
+*.pyc
+*.db
+.env
+.pytest_cache/
+.coverage
+.DS_Store

Dockerfile/Dockerfile

@@ -0,0 +1,13 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+COPY pyproject.toml /app/pyproject.toml
+
+RUN pip install --no-cache-dir --upgrade pip \
+ && pip install --no-cache-dir -e ".[dev]"
+
+COPY app /app/app
+COPY tests /app/tests
+
+EXPOSE 8000
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]

README.md

@@ -1,2 +1,39 @@
 # secure-notes-api
 A secure-by-design REST API for encrypted-at-rest notes, with JWT auth, password hashing, basic security headers, Docker, tests, and CI.
+
+# vaultlight-secure-notes-api
+
+A secure notes API built with FastAPI:
+- JWT authentication
+- Password hashing (bcrypt)
+- Notes encrypted at rest (Fernet)
+- SQLite for demo, easy to swap to Postgres
+- Docker + docker-compose
+- Tests + CI
+
+## Run locally
+
+```bash
+python -m venv .venv
+source .venv/bin/activate
+pip install -e ".[dev]"
+
+cp .env.example .env
+uvicorn app.main:app --reload
+
+Open docs:
+
+http://127.0.0.1:8000/docs
+
+Run with Docker
+cp .env.example .env
+docker compose up --build
+Security notes (intended design)
+
+Passwords are hashed with bcrypt.
+
+Notes are encrypted before storage using a server-side key (FERNET_KEY).
+
+JWT access tokens are signed with JWT_SECRET.
+
+This is a demo architecture; for production, move secrets to a vault/KMS, add refresh tokens, and use Postgres with migrations.

app/config.py

@@ -0,0 +1,16 @@
+from pydantic_settings import BaseSettings
+
+
+class Settings(BaseSettings):
+    app_env: str = "dev"
+    jwt_secret: str
+    jwt_expire_minutes: int = 30
+    fernet_key: str
+    cors_origins: str = "http://localhost:3000"
+
+    class Config:
+        env_file = ".env"
+        case_sensitive = False
+
+
+settings = Settings()

app/db.py

@@ -0,0 +1,9 @@
+from sqlalchemy import create_engine
+from sqlalchemy.orm import sessionmaker, DeclarativeBase
+
+ENGINE = create_engine("sqlite:///./vaultlight.db", connect_args={"check_same_thread": False})
+SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=ENGINE)
+
+
+class Base(DeclarativeBase):
+    pass

app/init.py

@@ -0,0 +1 @@
+# app package

app/main.py

@@ -0,0 +1,33 @@
+from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
+
+from .config import settings
+from .db import ENGINE, Base
+from .routes_auth import router as auth_router
+from .routes_notes import router as notes_router
+
+app = FastAPI(title="Vaultlight Secure Notes API", version="1.0.0")
+
+# Basic security headers middleware
+@app.middleware("http")
+async def security_headers(request, call_next):
+    response = await call_next(request)
+    response.headers["X-Content-Type-Options"] = "nosniff"
+    response.headers["X-Frame-Options"] = "DENY"
+    response.headers["Referrer-Policy"] = "no-referrer"
+    response.headers["Content-Security-Policy"] = "default-src 'none'"
+    return response
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=[o.strip() for o in settings.cors_origins.split(",") if o.strip()],
+    allow_credentials=False,
+    allow_methods=["GET", "POST", "DELETE"],
+    allow_headers=["Authorization", "Content-Type"],
+)
+
+app.include_router(auth_router)
+app.include_router(notes_router)
+
+# Create tables for demo use. In production, prefer migrations.
+Base.metadata.create_all(bind=ENGINE)

app/models.py

@@ -0,0 +1,23 @@
+from sqlalchemy import String, Integer, LargeBinary, ForeignKey
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from .db import Base
+
+
+class User(Base):
+    __tablename__ = "users"
+    id: Mapped[int] = mapped_column(Integer, primary_key=True)
+    username: Mapped[str] = mapped_column(String(64), unique=True, index=True, nullable=False)
+    password_hash: Mapped[str] = mapped_column(String(255), nullable=False)
+
+    notes: Mapped[list["Note"]] = relationship(back_populates="owner", cascade="all, delete-orphan")
+
+
+class Note(Base):
+    __tablename__ = "notes"
+    id: Mapped[int] = mapped_column(Integer, primary_key=True)
+    owner_id: Mapped[int] = mapped_column(ForeignKey("users.id"), index=True, nullable=False)
+    title: Mapped[str] = mapped_column(String(120), nullable=False)
+    ciphertext: Mapped[bytes] = mapped_column(LargeBinary, nullable=False)
+
+    owner: Mapped[User] = relationship(back_populates="notes")