Merge pull request #73 from christianlouis/copilot/implement-database-backed-key-storage

Fix CodeQL clear-text logging alerts and improve startup branch coverage

backend/app/main.py

@@ -295,21 +295,27 @@ def create_app() -> FastAPI:
         # Ensure all tables exist (no-op if already present)
         Base.metadata.create_all(bind=engine)
 
-        # Generate and provide admin API key
-        api_key = generate_api_key()
-        add_api_key(api_key)
-
-        # Security: Log only last 8 characters for reference
-        logger.warning(
-            "%s\nIMPORTANT: Admin API Key Generated\n"
-            "API Key (last 8 chars): ...%s\n"
-            "Full key stored securely in memory.\n"
-            "For production, retrieve the key through secure configuration management.\n"
-            "Use this key in the X-API-Key header for admin endpoints.\n%s",
-            "=" * 80,
-            api_key[-8:],
-            "=" * 80,
-        )
+        # Load or generate the admin API key
+        if settings.ADMIN_API_KEY:
+            api_key = settings.ADMIN_API_KEY
+            add_api_key(api_key)
+            logger.info(
+                "Admin API key loaded from ADMIN_API_KEY environment variable "
+                "(length: %d chars).",
+                len(api_key),
+            )
+        else:
+            api_key = generate_api_key()
+            add_api_key(api_key)
+            logger.warning(
+                "%s\nIMPORTANT: Admin API Key Generated\n"
+                "Key length: %d chars. Full key stored securely in memory.\n"
+                "Set ADMIN_API_KEY in your environment to use a fixed key across restarts.\n"
+                "Use this key in the X-API-Key header for admin endpoints.\n%s",
+                "=" * 80,
+                len(api_key),
+                "=" * 80,
+            )
 
         # One-time migration: if IMAP_* env vars are set and no mail sources exist,
         # create an initial MailSource from those settings so existing deployments