iShield Server

A secure Flask server with JWT authentication, user management, and both API and HTML serving capabilities.

Features

• 🔐 Secure Authentication: JWT-based authentication system with password hashing
• 👤 User Management: Register, login, and user profile management
• 🚀 RESTful API: Clean API endpoints for integration with other services
• 🎨 Modern UI: Responsive HTML templates with a dark theme
• 🛡️ Security: Password validation, SQL injection protection, and secure token handling
• 📊 Database: SQLite database with SQLAlchemy ORM

Installation

1. Clone or navigate to the repository:

   cd c:\Users\Sovr6\OneDrive\Desktop\ishield-server
   

2. Create a virtual environment (recommended):

   python -m venv venv
   .\venv\Scripts\Activate.ps1
   

3. Install dependencies:

   pip install -r requirements.txt
   

4. Configure environment variables (optional): Create a .env file in the root directory:

   SECRET_KEY=your-secret-key-here
   JWT_SECRET_KEY=your-jwt-secret-key-here
   DEBUG=False
   PORT=5000
   

5. Run the server:

   python app.py
   

Production (Docker)

This repo includes a production-friendly Docker setup:

• Web container runs Gunicorn with an eventlet worker (required for Flask-SocketIO).
• Database runs PostgreSQL in a separate container.
• Persistent volumes are used for Postgres data, instance/ (local vector store files), and uploads/.

Quick start

1. Ensure Docker Desktop is installed and running.

2. Start the stack:

docker compose up --build

CUDA / GPU

This repo defaults to CPU-only PyTorch wheels to keep the Docker image smaller.

There are two separate things you might want:

1. Build a CUDA-capable image (installs CUDA PyTorch wheels)
2. Run with GPU access (container requests an NVIDIA GPU at runtime)

Those map to:

• Build-time: USE_CUDA=True (controls which PyTorch wheels are installed during docker build).
• Runtime: enable the cuda Compose profile (runs the web-cuda service, which requests GPUs).

Option A: CPU-only (default)

docker compose up --build

Option B: CUDA image + GPU runtime (recommended for actual CUDA use)

PowerShell:

$env:COMPOSE_PROFILES = "cuda"
$env:USE_CUDA = "True"
docker compose up --build

bash/zsh:

COMPOSE_PROFILES=cuda USE_CUDA=True docker compose up --build

Option C: Build CUDA wheels but run the normal service

If you only set USE_CUDA=True without the profile, Compose will still run the normal web service (no GPU request), but the image will contain CUDA wheels:

USE_CUDA=True docker compose up --build

This can be useful for CI/build testing, but for real GPU access you typically want the cuda profile.

CUDA notes / requirements

• GPU access requires NVIDIA drivers + NVIDIA Container Toolkit on the host.
• Docker Desktop on Windows typically requires WSL2 + NVIDIA support enabled.
• You can override the PyTorch wheel index with TORCH_INDEX_URL.
  • Example: TORCH_INDEX_URL=https://download.pytorch.org/whl/cu118
  • Default when USE_CUDA=True is https://download.pytorch.org/whl/cu121

3. Open:

• http://localhost:5000
• Health check: http://localhost:5000/health

Configuration

Edit environment variables in docker-compose.yml (recommended for local docker testing) or inject them via your deployment platform.

Important env vars:

• FLASK_ENV=production (switches config.py into production behavior)
• DATABASE_URL=postgresql+psycopg2://... (SQLAlchemy connection string)
• SECRET_KEY and JWT_SECRET_KEY (set real secrets in production)

Security hardening notes

Recent changes (important for deployments):

• Role escalation prevention: POST /auth/register always creates role=user. Any role field in the request is ignored.
• Chat XSS mitigation: chat messages are rendered with safe text insertion (no innerHTML).
• Vision Socket.IO auth required: /vision connections require a valid API key (X-API-Key header or ?api_key= query param). Unauthenticated clients are disconnected.
• Vision encryption key:
  • In production, VISION_ENCRYPTION_KEY must be set or the server will fail fast.
  • The server no longer logs encryption keys and does not provide a get_key endpoint.
• CORS/origins are configurable:
  • Set CORS_ALLOWED_ORIGINS to a comma-separated allowlist (example: https://your-ui.example.com,http://localhost:3000).
  • Development default is * for convenience.
  • Production default is same-origin only (no cross-origin CORS) unless you set CORS_ALLOWED_ORIGINS.
• Upload size limits: set MAX_UPLOAD_MB (default 10). Flask uses this to reject overly large requests.

API key behavior:

• POST /auth/api-keys returns api_secret once at creation time.
• GET /auth/api-keys no longer returns api_secret (it only returns api_key and whether a secret exists).

Notes on secrets

If you have committed real API keys or tokens into .env, rotate them and remove them from version control. For safety, .env is ignored by .dockerignore so it won't be baked into Docker images.

6. Access the application:
   • Home: http://localhost:5000
   • Login: http://localhost:5000/login
   • Register: http://localhost:5000/register
   • Dashboard: http://localhost:5000/dashboard

API Endpoints

Authentication Endpoints

• POST /auth/register - Register a new user

  {
    "username": "user123",
    "email": "user@example.com",
    "password": "SecurePass123"
  }
  

• POST /auth/login - Login and get JWT token

  {
    "username": "user123",
    "password": "SecurePass123"
  }
  

• POST /auth/refresh - Refresh access token (requires refresh token)

• GET /auth/me - Get current user info (requires JWT token)

• POST /auth/logout - Logout user

API Endpoints

• GET /api/status - Check API status (public)

• GET /api/protected - Protected endpoint example (requires JWT token)

• GET /api/users - Get all users (requires JWT token)

Other Endpoints

• GET /health - Health check endpoint

Usage Example

Using the API with JavaScript (Fetch):

// Register
const response = await fetch('http://localhost:5000/auth/register', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json'
    },
    body: JSON.stringify({
        username: 'newuser',
        email: 'user@example.com',
        password: 'SecurePass123'
    })
});

const data = await response.json();
const token = data.access_token;

// Access protected endpoint
const protectedResponse = await fetch('http://localhost:5000/api/protected', {
    headers: {
        'Authorization': `Bearer ${token}`
    }
});

Using the API with Python (requests):

import requests

# Register
response = requests.post('http://localhost:5000/auth/register', json={
    'username': 'newuser',
    'email': 'user@example.com',
    'password': 'SecurePass123'
})

token = response.json()['access_token']

# Access protected endpoint
headers = {'Authorization': f'Bearer {token}'}
protected_response = requests.get('http://localhost:5000/api/protected', headers=headers)

Project Structure

ishield-server/
├── app.py                  # Main Flask application
├── config.py               # Configuration settings
├── requirements.txt        # Python dependencies
├── README.md              # This file
├── src/
│   ├── auth.py            # Authentication blueprint
│   ├── api.py             # API blueprint
│   ├── models.py          # Database models
│   └── vision/            # Your existing vision modules
├── templates/             # HTML templates
│   ├── index.html
│   ├── login.html
│   ├── register.html
│   └── dashboard.html
└── static/               # Static files
    ├── css/
    │   └── style.css
    └── js/
        ├── login.js
        ├── register.js
        └── dashboard.js

Security Notes

⚠️ IMPORTANT: Before deploying to production:

1. Change the SECRET_KEY and JWT_SECRET_KEY in config.py or use environment variables
2. Set DEBUG=False in production
3. Use a production-grade database (PostgreSQL, MySQL) instead of SQLite
4. Enable HTTPS
5. Implement rate limiting
6. Add additional security headers
7. Consider using environment variables for all sensitive configuration

Password Requirements

• Minimum 8 characters
• At least one uppercase letter
• At least one lowercase letter
• At least one number

License

MIT License

Contributing

Feel free to submit issues and enhancement requests!