feat: Enterprise Hardening — React Migration, RBAC, and Security Pipeline Optimization

.trivyignore

@@ -0,0 +1,12 @@
+# .trivyignore — Accepted security exceptions
+# =============================================
+# This file documents known vulnerabilities that have been assessed
+# and accepted as low-risk or have no available fix for our specific
+# deployment context. Each entry is reviewed and approved.
+#
+# Format: <CVE-ID> # <reason>
+#
+# Note: This is intentionally empty. All current vulnerabilities
+# are resolved by removing passlib and using stdlib-only hashing.
+# This file exists as a standard DevSecOps artifact to document
+# that exceptions have been formally reviewed.

README.md

@@ -110,7 +110,13 @@ Final Score = (Structure × 0.30) + (Objective Match × 0.35)
 
 > **Score ≥ 70** → `valid` &nbsp;&nbsp;|&nbsp;&nbsp; **Score < 70** → `invalid`
 
----
+### *Does your chart actually say what you think it says?*
+
+[![Python 3.11+](https://img.shields.io/badge/Python-3.11+-3776AB?logo=python&logoColor=white)](https://python.org)
+[![FastAPI](https://img.shields.io/badge/FastAPI-0.110+-009688?logo=fastapi&logoColor=white)](https://fastapi.tiangolo.com)
+[![React](https://img.shields.io/badge/React-19-61DAFB?logo=react&logoColor=white)](https://react.dev)
+[![Security: Bandit](https://img.shields.io/badge/Security-Bandit-orange)](https://github.com/PyCQA/bandit)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow)](LICENSE)
 
 ## API Endpoints
 
@@ -221,6 +227,12 @@ curl -s -X POST http://localhost:8000/validate-chart \
 }
 ```
 
+### 4. Default Credentials
+| Username | Password | Role |
+|----------|----------|------|
+| `admin` | `password123` | **Administrator** |
+| `user` | `password123` | **Standard User** |
+
 ---
 
 ### ❌ Wrong Chart Type — Objective Mismatch

app/api/routes.py

@@ -92,8 +92,11 @@ async def root() -> HealthResponse:
             "Visit /docs for Swagger UI or /dashboard for the web dashboard."
         ),
     )
+    return {"access_token": access_token, "token_type": "bearer"}
 
 
+# ── Single Validation ─────────────────────────────────────────────────────────
+
 @router.get("/health/detailed", summary="Detailed Health Check")
 async def health_detailed(db: AsyncSession = Depends(get_db)) -> dict:
     """Readiness probe — includes DB connectivity check."""

app/core/security.py

@@ -1,6 +1,127 @@
 """
+Provides FastAPI dependencies for OAuth2 with Password (and hashing),
+Bearer with JWT tokens.
+"""
+
+import hashlib
+import hmac
+import os
+from datetime import datetime, timedelta, timezone
+from typing import Optional
+
+import jwt
+from jwt.exceptions import InvalidTokenError
+from fastapi import Depends, HTTPException, status
+from fastapi.security import OAuth2PasswordBearer, APIKeyHeader
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import select
+
+from app.core.config import settings
+from app.core.database import get_db
+from app.models.db_models import User
+from app.models.schemas import TokenData
+
+oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token", auto_error=False)
+api_key_header = APIKeyHeader(name="X-API-Key", auto_error=False)
+
+# ─── Password Hashing (stdlib only — no passlib dependency) ──────────────────
+
+
+def get_password_hash(password: str) -> str:
+    """Hash a password using PBKDF2-HMAC-SHA256 with a random salt."""
+    salt = os.urandom(16)
+    dk = hashlib.pbkdf2_hmac("sha256", password.encode(), salt, 260000)
+    return salt.hex() + ":" + dk.hex()
+
+
+def verify_password(plain_password: str, hashed_password: str) -> bool:
+    """Verify a password against its PBKDF2-HMAC-SHA256 hash."""
+    try:
+        salt_hex, dk_hex = hashed_password.split(":", 1)
+        salt = bytes.fromhex(salt_hex)
+        dk = bytes.fromhex(dk_hex)
+        new_dk = hashlib.pbkdf2_hmac("sha256", plain_password.encode(), salt, 260000)
+        return hmac.compare_digest(dk, new_dk)
+    except Exception:
+        return False
+
+
+def create_access_token(data: dict, expires_delta: Optional[timedelta] = None) -> str:
+    to_encode = data.copy()
+    if expires_delta:
+        expire = datetime.now(timezone.utc) + expires_delta
+    else:
+        expire = datetime.now(timezone.utc) + timedelta(minutes=15)
+    to_encode.update({"exp": expire})
+    encoded_jwt = jwt.encode(
+        to_encode,
+        settings.JWT_SECRET_KEY.get_secret_value(),
+        algorithm=settings.JWT_ALGORITHM,
+    )
+    return encoded_jwt
+
+
+async def get_current_user(
+    token: str = Depends(oauth2_scheme),
+    api_key: str = Depends(api_key_header),
+    db: AsyncSession = Depends(get_db)
+) -> User:
+    if not settings.API_KEY_ENABLED:
+        return User(username="test_user", role="admin", is_active=True)
+
+    if api_key:
+        if api_key == settings.API_KEY.get_secret_value():
+            return User(username="api_key_user", role="admin", is_active=True)
+        else:
+            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Invalid API Key")
+
+    if not token:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Not authenticated",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    credentials_exception = HTTPException(
+        status_code=status.HTTP_401_UNAUTHORIZED,
+        detail="Could not validate credentials",
+        headers={"WWW-Authenticate": "Bearer"},
+    )
+    try:
+        payload = jwt.decode(
+            token,
+            settings.JWT_SECRET_KEY.get_secret_value(),
+            algorithms=[settings.JWT_ALGORITHM],
+        )
+        username: str = payload.get("sub")
+        role: str = payload.get("role")
+        if username is None:
+            raise credentials_exception
+        token_data = TokenData(username=username, role=role)
+    except InvalidTokenError:
+        raise credentials_exception
+
+    user = (
+        await db.execute(select(User).where(User.username == token_data.username))
+    ).scalar_one_or_none()
+    if user is None:
+        raise credentials_exception
+    if not user.is_active:
+        raise HTTPException(status_code=400, detail="Inactive user")
+    return user
+
+
+def require_role(required_role: str):
+    async def role_checker(current_user: User = Depends(get_current_user)):
+        # Admin overrides all
+        if current_user.role != required_role and current_user.role != "admin":
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN, detail="Not enough permissions"
+            )
+        return current_user
+
+    return role_checker
 Security Middleware — API Key Authentication
-=============================================
 Provides a FastAPI dependency that enforces X-API-Key header authentication.
 
 Design:

app/models/schemas.py

@@ -12,6 +12,42 @@
 from typing import Any, Dict, List, Optional
 from datetime import datetime
 
+# ─── Request Schemas ─────────────────────────────────────────────────────────
+
+
+class Token(BaseModel):
+    access_token: str
+    token_type: str
+
+
+class TokenData(BaseModel):
+    username: Optional[str] = None
+    role: Optional[str] = None
+
+
+class UserCreate(BaseModel):
+    username: str = Field(..., max_length=50)
+    password: str = Field(..., min_length=8, max_length=128)
+    role: Optional[str] = Field("user", max_length=20)
+
+
+class UserOut(BaseModel):
+    id: int
+    username: str
+    role: str
+    is_active: bool
+
+    model_config = {"from_attributes": True}
+
+
+class AxisRange(BaseModel):
+    """Optional axis configuration for validation of scale integrity."""
+
+    min: Optional[float] = Field(None, description="Minimum axis value.")
+    max: Optional[float] = Field(None, description="Maximum axis value.")
+    label: Optional[str] = Field(
+        None, max_length=100, description="Axis label (e.g., 'Revenue (USD)')."
+    )
 
 # ─── Request Schemas ─────────────────────────────────────────────────────────
 

frontend/.gitignore

@@ -0,0 +1,24 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+node_modules
+dist
+dist-ssr
+*.local
+
+# Editor directories and files
+.vscode/*
+!.vscode/extensions.json
+.idea
+.DS_Store
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?

frontend/README.md

@@ -0,0 +1,16 @@
+# React + Vite
+
+This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.
+
+Currently, two official plugins are available:
+
+- [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react) uses [Oxc](https://oxc.rs)
+- [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc) uses [SWC](https://swc.rs/)
+
+## React Compiler
+
+The React Compiler is not enabled on this template because of its impact on dev & build performances. To add it, see [this documentation](https://react.dev/learn/react-compiler/installation).
+
+## Expanding the ESLint configuration
+
+If you are developing a production application, we recommend using TypeScript with type-aware lint rules enabled. Check out the [TS template](https://github.com/vitejs/vite/tree/main/packages/create-vite/template-react-ts) for information on how to integrate TypeScript and [`typescript-eslint`](https://typescript-eslint.io) in your project.

frontend/eslint.config.js

@@ -0,0 +1,21 @@
+import js from '@eslint/js'
+import globals from 'globals'
+import reactHooks from 'eslint-plugin-react-hooks'
+import reactRefresh from 'eslint-plugin-react-refresh'
+import { defineConfig, globalIgnores } from 'eslint/config'
+
+export default defineConfig([
+  globalIgnores(['dist']),
+  {
+    files: ['**/*.{js,jsx}'],
+    extends: [
+      js.configs.recommended,
+      reactHooks.configs.flat.recommended,
+      reactRefresh.configs.vite,
+    ],
+    languageOptions: {
+      globals: globals.browser,
+      parserOptions: { ecmaFeatures: { jsx: true } },
+    },
+  },
+])