feat: add CORSMiddleware and TrustedHostMiddleware to FastAPI app

This change adds CORSMiddleware and TrustedHostMiddleware to the FastAPI application in src/regression_model_template/controller/kafka_app.py.
It allows configuration via ALLOWED_ORIGINS and ALLOWED_HOSTS environment variables, defaulting to "*" for development convenience.
This addresses a security gap where the application was running without basic security headers.

A new test `tests/controller/test_middleware_security.py` has been added to verify the middleware configuration.

Co-authored-by: lgcorzo <46710567+lgcorzo@users.noreply.github.com>

Author: google-labs-jules[bot]

.jules/sentinel.md

@@ -12,3 +12,8 @@
 **Vulnerability:** The application was catching exceptions in logic callbacks and Kafka consumers, then assigning the raw exception string to a JSON `error` field in the successful response object. This leaked internal details even when the HTTP status code was 200 OK or when processing asynchronously via Kafka.
 **Learning:** Checking for HTTP 500 handlers is not enough. Review application-level error handling where business logic manually constructs error objects.
 **Prevention:** Ensure that any `result["error"]` or similar fields populated in catch blocks use generic messages, while the real exception is logged server-side.
+
+## 2026-03-05 - Missing Security Middleware in FastAPI
+**Vulnerability:** The FastAPI application was initialized without `CORSMiddleware` or `TrustedHostMiddleware`, making it vulnerable to CORS attacks and Host header injection.
+**Learning:** Default FastAPI initialization does not include security headers. Explicit configuration is required.
+**Prevention:** Always add `TrustedHostMiddleware` and `CORSMiddleware` with configurable allowed hosts/origins via environment variables. Verify configuration by inspecting `app.user_middleware`.

src/regression_model_template/controller/kafka_app.py

@@ -12,6 +12,8 @@
 import uvicorn
 import pandas as pd
 from fastapi import FastAPI, HTTPException
+from fastapi.middleware.cors import CORSMiddleware
+from fastapi.middleware.trustedhost import TrustedHostMiddleware
 from pydantic import BaseModel
 
 from confluent_kafka import Producer, Consumer, KafkaError, Message
@@ -31,6 +33,9 @@
 DEFAULT_FASTAPI_PORT = int(os.getenv("DEFAULT_FASTAPI_PORT", 8100))
 LOGGING_FORMAT = "%(asctime)s - %(levelname)s - %(message)s"
 
+# Security Configuration
+ALLOWED_HOSTS = os.getenv("ALLOWED_HOSTS", "*").split(",")
+ALLOWED_ORIGINS = os.getenv("ALLOWED_ORIGINS", "*").split(",")
 
 # Configure logging
 logging.basicConfig(level=logging.INFO, format=LOGGING_FORMAT)
@@ -43,6 +48,20 @@
     version="1.0.0",
 )
 
+# Add Middleware
+app.add_middleware(
+    TrustedHostMiddleware,
+    allowed_hosts=ALLOWED_HOSTS,
+)
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=ALLOWED_ORIGINS,
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
 
 # Data Models
 class PredictionRequest(BaseModel):

tests/controller/test_middleware_security.py

@@ -0,0 +1,29 @@
+from fastapi.middleware.cors import CORSMiddleware
+from fastapi.middleware.trustedhost import TrustedHostMiddleware
+from regression_model_template.controller.kafka_app import app
+import os
+
+def test_middleware_security_configuration():
+    """Test that CORSMiddleware and TrustedHostMiddleware are configured."""
+    middleware_types = [m.cls for m in app.user_middleware]
+
+    # Check if CORSMiddleware is present
+    assert CORSMiddleware in middleware_types, "CORSMiddleware should be added to the app."
+
+    # Check if TrustedHostMiddleware is present
+    assert TrustedHostMiddleware in middleware_types, "TrustedHostMiddleware should be added to the app."
+
+    # Check configuration (using defaults if env vars are not set)
+    # Note: Env vars might affect these checks if set in the test environment.
+    # We assume defaults here or modify the test to mock env vars if needed.
+
+    for middleware in app.user_middleware:
+        if middleware.cls == CORSMiddleware:
+            # Check options - assuming defaults are set to ["*"] if not overridden
+            assert middleware.kwargs['allow_origins'] == os.getenv("ALLOWED_ORIGINS", "*").split(","), "CORSMiddleware allow_origins mismatch"
+            assert middleware.kwargs['allow_credentials'] is True, "CORSMiddleware allow_credentials mismatch"
+            assert middleware.kwargs['allow_methods'] == ["*"], "CORSMiddleware allow_methods mismatch"
+            assert middleware.kwargs['allow_headers'] == ["*"], "CORSMiddleware allow_headers mismatch"
+        elif middleware.cls == TrustedHostMiddleware:
+             # Check options - assuming defaults are set to ["*"] if not overridden
+            assert middleware.kwargs['allowed_hosts'] == os.getenv("ALLOWED_HOSTS", "*").split(","), "TrustedHostMiddleware allowed_hosts mismatch"