API SECURITY, HF REFACTOR OF SCORING.

[Arrmlet]

API Security Update

Added API Key Authentication and Rate Limiting System

New Features:

1. Two-Tier API Key System
   • Master key for validator owners (administrative access)
   • Regular API keys for users
   • SQLite-based key storage and management
2. Key Management Endpoints
   • POST /api/v1/keys - Create new API keys (master key required)
   • GET /api/v1/keys - List all API keys (master key required)
   • GET /api/v1/keys/{key}/deactivate - Deactivate API keys (master key required)
3. Rate Limiting
   • Regular API keys: 100 requests/hour
   • Master key: 1000 requests/hour
   • Rolling window implementation
   • Rate limit headers in responses
4. Protected Endpoints
   • Regular data endpoints require valid API key
   • Administrative endpoints require master key
   • Set desirabilities endpoint restricted to master key only

Technical Implementation:

• SQLite database for key storage and rate limiting
• Thread-safe implementation for concurrent access
• Automatic cleanup of old rate limit records
• Response headers for rate limit tracking

Configuration:

• Master key configurable via environment variable: MASTER_KEY
• Database file auto-generated: api_keys.db

Security Improvements:

• Protected documentation endpoints
• Rate limit protection against DDoS
• Secure key generation and storage
• Thread-safe operations

Change date from 27th. Reduce limit from 400 to 200 to make upload more brief( to be changed on 27th)