fix(audit): resolve critical config API keys, Dockerfile engine copy, secrets.compare_digest, async embedding thread offload, and formulas path traversal

Author: sharriffajar

config.py

@@ -45,6 +45,12 @@ class Config:
     LLAMAPARSE_API_KEY: str = os.getenv("LLAMAPARSE_API_KEY", "").strip()
     UNSTRUCTURED_API_KEY: str = os.getenv("UNSTRUCTURED_API_KEY", "").strip()
     UNSTRUCTURED_SERVER_URL: str = os.getenv("UNSTRUCTURED_SERVER_URL", "https://api.unstructured.io/general/v0/general").strip()
+
+    # Cloud LLM API Keys
+    GEMINI_API_KEY: str = os.getenv("GEMINI_API_KEY", "").strip()
+    OPENAI_API_KEY: str = os.getenv("OPENAI_API_KEY", "").strip()
+    GROQ_API_KEY: str = os.getenv("GROQ_API_KEY", "").strip()
+
     # Security & API Auth
     API_KEY: str = os.getenv("API_KEY", "").strip()
 
@@ -69,5 +75,7 @@ def validate_keys(cls) -> dict:
             "LlamaParse": "READY" if cls.LLAMAPARSE_API_KEY else "NOT SET",
             "Unstructured": "READY" if cls.UNSTRUCTURED_API_KEY else "NOT SET",
             "Gemini": "READY" if cls.GEMINI_API_KEY else "NOT SET",
+            "OpenAI": "READY" if cls.OPENAI_API_KEY else "NOT SET",
+            "Groq": "READY" if cls.GROQ_API_KEY else "NOT SET",
             "Local Fallback": "pypdf (Always Available)"
         }

docker/Dockerfile

@@ -34,6 +34,7 @@ ENV PYTHONDONTWRITEBYTECODE=1
 # Copy application source code
 COPY config.py server.py cli.py ./
 COPY json_ld_extractor/ ./json_ld_extractor/
+COPY corpusld_engine/ ./corpusld_engine/
 COPY services/ ./services/
 COPY routes/ ./routes/
 COPY frontend/ ./frontend/

routes/chat.py

@@ -62,7 +62,7 @@ async def chat_rag(req: ChatRequest):
             ]
         )
 
-    query_vector = embedder.encode(req.query).tolist()
+    query_vector = (await asyncio.to_thread(embedder.encode, req.query)).tolist()
     search_results = qdrant.query_points(
         collection_name=Config.QDRANT_COLLECTION_NAME,
         query=query_vector,

routes/exports.py

@@ -138,6 +138,7 @@ async def get_document_terms(file_name: str):
 
 @router.get("/api/documents/{file_name}/formulas")
 async def get_document_formulas(file_name: str):
+    validate_safe_filename(file_name)
     stored = get_persisted_document(file_name)
     if stored:
         data = stored["schema_json_ld"] if "schema_json_ld" in stored else stored

server.py

@@ -117,6 +117,8 @@ async def lifespan(app: FastAPI):
 )
 
 
+import secrets
+
 # ---------------------------------------------------------
 # OPTIONAL API KEY AUTHENTICATION MIDDLEWARE
 # ---------------------------------------------------------
@@ -130,7 +132,7 @@ async def api_key_auth_middleware(request: Request, call_next):
             if auth_header.startswith("Bearer "):
                 client_key = auth_header[7:].strip()
 
-            if not client_key or client_key != Config.API_KEY:
+            if not client_key or not secrets.compare_digest(client_key, Config.API_KEY):
                 return JSONResponse(
                     status_code=401,
                     content={"success": False, "error": True, "message": "Unauthorized: Invalid or missing X-API-Key header.", "status_code": 401}