feat: harden production data and backups

apps/api/app/main.py

@@ -5,6 +5,7 @@ from datetime import datetime, timedelta, timezone
 import hashlib
 import hmac
 import logging
+import secrets
 import time as time_module
 from typing import Annotated, Literal
 from uuid import UUID
@@ -25,7 +26,7 @@ from .importer import ImportSourceError, import_records, normalize
 from .logging_config import configure_logging
 from .models import Bait, BaitKind, CatchReport, ExternalObservation, Fish, ModerationEvent, ModerationStatus, OfficialRecordImport, SourceType, Spot, SubmissionAttempt, Waterbody
 from .readiness import readiness_report
-from .schemas import ActivityOut, AdminCatchReportOut, BaitOut, CatchOut, CatchReportCreate, CatchReportCreated, ExternalObservationDecision, ExternalObservationMapping, ExternalObservationOut, ExternalObservationPublished, FishOut, ImportRunOut, ModerationUpdate, OfficialRecordOut, SpotOut, WaterbodyOut
+from .schemas import ActivityOut, AdminCatchReportOut, BaitOut, CatchOut, CatchReportAccepted, CatchReportCreate, CatchReportCreated, ExternalObservationDecision, ExternalObservationMapping, ExternalObservationOut, ExternalObservationPublished, FishOut, ImportRunOut, ModerationUpdate, OfficialRecordOut, SpotOut, WaterbodyOut
 from .storage import ScreenshotError, client as storage_client, delete_screenshot, signed_screenshot_url, upload_screenshot
 
 
@@ -273,8 +274,8 @@ def admin_reject_external_observation(
         raise HTTPException(status_code=409, detail=str(exc)) from exc
 
 
-@app.post("/api/v1/catch-reports", response_model=CatchReportCreated, status_code=201)
-def create_catch_report(payload: CatchReportCreate, request: Request, db: Db) -> CatchReportCreated:
+@app.post("/api/v1/catch-reports", response_model=CatchReportAccepted, status_code=201)
+def create_catch_report(payload: CatchReportCreate, request: Request, db: Db) -> CatchReportAccepted:
     if payload.website:
         raise HTTPException(status_code=400, detail="invalid submission")
     _check_rate_limit(request.client.host if request.client else "unknown", db)
@@ -293,17 +294,24 @@ def create_catch_report(payload: CatchReportCreate, request: Request, db: Db) ->
         if bait is None:
             bait = Bait(name=payload.bait_name.strip(), normalized_name=key, kind=BaitKind.unknown)
             db.add(bait)
-    report = CatchReport(fish=fish, spot=spot, waterbody=waterbody, bait=bait, weight_g=payload.weight_g, fishing_method=payload.fishing_method, rig_type=payload.rig_type, retrieve_method=payload.retrieve_method, retrieve_speed=payload.retrieve_speed, caught_at=payload.caught_at, reported_at=datetime.now(timezone.utc), player_name=payload.player_name, source_type=SourceType.user, source_url=payload.source_url, source_confidence=60, moderation_status=ModerationStatus.pending, raw_payload={"comment": payload.comment} if payload.comment else None)
+    upload_token = secrets.token_urlsafe(32)
+    report = CatchReport(fish=fish, spot=spot, waterbody=waterbody, bait=bait, weight_g=payload.weight_g, fishing_method=payload.fishing_method, rig_type=payload.rig_type, retrieve_method=payload.retrieve_method, retrieve_speed=payload.retrieve_speed, caught_at=payload.caught_at, reported_at=datetime.now(timezone.utc), player_name=payload.player_name, source_type=SourceType.user, source_url=payload.source_url, source_confidence=60, moderation_status=ModerationStatus.pending, raw_payload={"comment": payload.comment} if payload.comment else None, screenshot_upload_token_hash=hashlib.sha256(upload_token.encode()).hexdigest())
     db.add(report)
     db.commit()
-    return CatchReportCreated(id=report.id, moderation_status=report.moderation_status.value)
+    return CatchReportAccepted(id=report.id, moderation_status=report.moderation_status.value, screenshot_upload_token=upload_token)
 
 
 @app.post("/api/v1/catch-reports/{report_id}/screenshot", status_code=204, response_class=Response)
-def add_screenshot(report_id: UUID, db: Db, screenshot: UploadFile = File()) -> Response:
+def add_screenshot(
+    report_id: UUID, db: Db, screenshot: UploadFile = File(),
+    upload_token: Annotated[str | None, Header(alias="X-Upload-Token")] = None,
+) -> Response:
     report = db.get(CatchReport, report_id)
     if report is None or report.source_type != SourceType.user or report.moderation_status != ModerationStatus.pending:
         raise HTTPException(status_code=404, detail="pending catch report not found")
+    supplied_hash = hashlib.sha256((upload_token or "").encode()).hexdigest()
+    if not report.screenshot_upload_token_hash or not hmac.compare_digest(report.screenshot_upload_token_hash, supplied_hash):
+        raise HTTPException(status_code=401, detail="invalid screenshot upload token")
     if report.screenshot_key:
         raise HTTPException(status_code=409, detail="screenshot already uploaded")
     raw = screenshot.file.read(settings.screenshot_max_bytes + 1)
@@ -311,6 +319,7 @@ def add_screenshot(report_id: UUID, db: Db, screenshot: UploadFile = File()) ->
         report.screenshot_key = upload_screenshot(raw, filename=screenshot.filename, content_type=screenshot.content_type)
     except ScreenshotError as exc:
         raise HTTPException(status_code=422, detail=str(exc)) from exc
+    report.screenshot_upload_token_hash = None
     db.commit()
     return Response(status_code=204)