fix: security hardening, connection pooling, and codebase cleanup

[BasitS-hash]

Summary

• Security: Remove JWT_SECRET weak fallback default — app now raises EnvironmentError at startup if the variable is missing instead of silently using "your-secret-key-change-me"
• Security: Untrack .env.production from git and replace the Node.js .gitignore template with a proper Python one
• Security: Fix naive timestamps in audit_log and /health — both now use datetime.now(timezone.utc) (also fixes Python 3.12 deprecation of utcnow())
• Bug: POST /entries/ now returns {"ok": true, "id": "<uuid>"} — previously the client had no way to reference a newly created entry without re-listing
• Bug: decode_entry_fields now validates that IV is exactly 12 bytes and tag is exactly 16 bytes (AES-GCM requirements), and returns a clear 400 on invalid base64 instead of a generic 500
• Performance: Replace per-query psycopg2.connect() with a ThreadedConnectionPool(2, 10) — the old approach would exhaust Postgres connections under any load
• Quality: Delete dead config.py — it was a Flask remnant, nothing in the codebase imported it, and it had hardcoded FLASK_ENV references
• Quality: Fix logger.py to respect the LOG_LEVEL env var and guard against duplicate handler registration on repeated imports
• Docker: Run as non-root appuser instead of root

Test plan

• All 22 non-DB tests pass (pytest tests/ without DATABASE_URL)
• DB-dependent tests pass in CI with Postgres service
• docker build . succeeds and app starts as non-root
• App refuses to start without JWT_SECRET set

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR hardens security configuration, improves operational behavior under load by introducing database connection pooling, and removes legacy/unsafe artifacts (tracked env file, dead config) across the FastAPI password manager API.

Changes:

• Enforce required secrets/env vars (notably JWT_SECRET), remove weak fallbacks, and stop tracking production env files.
• Add DB connection pooling and return newly-created entry IDs from POST /entries/.
• Normalize timestamps to UTC-aware datetimes, improve logging initialization, and run Docker container as a non-root user.

Reviewed changes

Copilot reviewed 13 out of 14 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/test_api.py	Asserts POST /entries/ includes an id in the response.
tests/conftest.py	Ensures JWT_SECRET is set during tests to avoid startup failures.
src/routes/entries.py	Adds stricter decoding/validation for AES-GCM fields and returns inserted entry id.
src/routes/auth.py	Removes insecure JWT secret fallback and requires JWT_SECRET.
src/middleware/auth.py	Removes insecure JWT secret fallback and requires JWT_SECRET for token validation.
src/middleware/audit.py	Writes audit timestamps as UTC-aware datetimes.
src/logger.py	Respects LOG_LEVEL and avoids duplicate handler registration.
src/db.py	Introduces a ThreadedConnectionPool and switches query/execute helpers to pooled connections.
Dockerfile	Creates a non-root user and runs the app as that user.
config.py	Removes unused legacy Flask-era configuration module.
app.py	Updates /health timestamp to use UTC-aware datetime.
.gitignore	Replaces Node-centric ignore rules with Python-appropriate ignores and ignores .env.production.
.env.production	Removes tracked production env file from the repository.
.env.example	Updates example env file guidance and variables.

Comments suppressed due to low confidence (1)

src/db.py:59

• execute() has the same issue as query(): cur.close() is called unconditionally in finally even though cur is assigned inside the try. If cursor creation fails, this will raise UnboundLocalError and can prevent the pooled connection from being returned.

def execute(sql, params=None):
    conn = get_connection()
    try:
        cur = conn.cursor()
        cur.execute(sql, params or ())

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.