add: auth, rate limiting, tests (backend+frontend), CI/CD, remove demo URLs

Author: abeermeer

.github/workflows/ci.yml

@@ -0,0 +1,55 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  backend:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: backend
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+
+      - name: Run tests
+        run: |
+          python -m pytest tests/ -v --no-header -p no:warnings
+        env:
+          DATABASE_URL: postgresql+asyncpg://localhost:5432/leadforge
+          GOOGLE_MAPS_API_KEY: test
+          GOOGLE_SERVICE_ACCOUNT_JSON: test
+
+  frontend:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: frontend
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "18"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests
+        run: npm test

README.md

@@ -4,15 +4,14 @@
   <img src="https://img.shields.io/badge/FastAPI-0.115-green?style=flat-square&logo=fastapi" alt="FastAPI">
   <img src="https://img.shields.io/badge/license-MIT-blue?style=flat-square" alt="MIT License">
   <img src="https://img.shields.io/badge/status-active-success?style=flat-square" alt="Status">
-  <img src="https://img.shields.io/badge/coverage-100%25-brightgreen?style=flat-square" alt="Coverage">
+
 
   <h1>LeadForge</h1>
   <p><strong>Find businesses without websites. Generate personalized outreach. Automate via email.</strong></p>
   <p>A complete lead generation platform that finds local businesses lacking an online presence, crafts targeted cold emails using smart templates, and automates delivery through Google Sheets + Apps Script.</p>
 
   <p>
     <a href="#features">Features</a> •
-    <a href="#demo">Demo</a> •
     <a href="#quick-start">Quick Start</a> •
     <a href="#deployment">Deployment</a> •
     <a href="#usage">Usage</a> •
@@ -32,15 +31,7 @@
 - **Apps Script Automation** — Copy-paste script sends batch emails from your Gmail (8 per 20 min, designed with opt-out footer)
 - **Duplicate Prevention** — Dedup by Google Place ID across all campaigns
 - **Background Processing** — Search runs asynchronously; poll campaign status from the dashboard
-- **Live Deployment** — Backend on Railway, frontend on Vercel, auto-deploys from GitHub
-
-## Demo
-
-| Service | URL | Status |
-|---------|-----|--------|
-| Frontend | [frontend-alpha-teal-72.vercel.app](https://frontend-alpha-teal-72.vercel.app) | ✅ Live |
-| Backend | [leadforge-production-126b.up.railway.app](https://leadforge-production-126b.up.railway.app) | ✅ Live |
-| Health | [leadforge-production-126b.up.railway.app/api/health](https://leadforge-production-126b.up.railway.app/api/health) | `{"status":"ok"}` |
+- **CI/CD** — GitHub Actions runs backend + frontend tests on every push
 
 ## Architecture
 
@@ -86,6 +77,8 @@ Search Form → POST /api/search → Grid Search (Places API)
 | **APIs** | Google Places API (New), Google Sheets API v4 |
 | **Automation** | Google Apps Script (Gmail send, quota-aware) |
 | **Infrastructure** | Railway.app, Vercel, Docker Compose (local dev) |
+| **CI/CD** | GitHub Actions (backend + frontend tests on push) |
+| **Testing** | pytest (backend), Jest + RTL (frontend) |
 
 ## Quick Start
 
@@ -157,7 +150,7 @@ Set `NEXT_PUBLIC_API_URL` to your Railway backend URL (e.g. `https://leadforge-p
 1. Push to GitHub
 2. Create a Railway project → "Deploy from GitHub repo" → select `abeermeer/LeadForge`
 3. Add **PostgreSQL** plugin (DATABASE_URL auto-injected)
-4. Set remaining env vars: `GOOGLE_MAPS_API_KEY`, `GOOGLE_SERVICE_ACCOUNT_JSON`
+4. Set remaining env vars: `GOOGLE_MAPS_API_KEY`, `GOOGLE_SERVICE_ACCOUNT_JSON`, `API_KEY`
 5. Railway builds using the `Dockerfile` at repo root
 
 The included `railway.json` configures Dockerfile builder with 1 replica and ON_FAILURE restart policy.
@@ -200,10 +193,12 @@ Emails send in batches of 8 every 20 minutes, respecting Gmail's 100/day quota (
 
 ## API Reference
 
+All endpoints (except `/api/health`) require `X-API-Key` header if `API_KEY` is set. POST `/api/search` is rate-limited to 5 requests per minute.
+
 | Method | Path | Description |
 |--------|------|-------------|
-| `GET` | `/api/health` | Health check |
-| `POST` | `/api/search` | Create search campaign (runs in background) |
+| `GET` | `/api/health` | Health check (no auth required) |
+| `POST` | `/api/search` | Create search campaign (rate-limited: 5/min) |
 | `GET` | `/api/search/{id}` | Poll campaign status |
 | `GET` | `/api/campaigns/{id}/leads` | List leads for campaign |
 | `PATCH` | `/api/leads/{id}` | Update lead email fields |
@@ -234,6 +229,7 @@ Allowlisted fields: `email`, `email_subject`, `email_body`, `angle_used`, `email
 |----------|-------------|----------|
 | `GOOGLE_MAPS_API_KEY` | Google Places API (New) key | ✅ |
 | `GOOGLE_SERVICE_ACCOUNT_JSON` | Service account key (base64 or raw JSON) | ✅ |
+| `API_KEY` | API key for auth (set to enable) | ❌ |
 | `DATABASE_URL` | PostgreSQL with async driver | ✅ |
 | `NEXT_PUBLIC_API_URL` | Backend URL (frontend only) | ✅ |
 
@@ -244,6 +240,7 @@ LeadForge/
 ├── backend/
 │   ├── main.py                  # FastAPI entry point
 │   ├── config.py                # Environment config
+│   ├── auth.py                  # API key authentication
 │   ├── database.py              # SQLAlchemy async engine
 │   ├── models/
 │   │   ├── campaign.py          # Campaign table model

backend/.env.example

@@ -1,3 +1,4 @@
 GOOGLE_MAPS_API_KEY=your_places_api_key_here
 GOOGLE_SERVICE_ACCOUNT_JSON=your_base64_or_raw_json_here
+API_KEY=your_api_key_here
 DATABASE_URL=postgresql+asyncpg://postgres:postgres@localhost:5432/leadforge

backend/auth.py

@@ -0,0 +1,19 @@
+import os
+import logging
+from fastapi import Security, HTTPException, status
+from fastapi.security import APIKeyHeader
+from .config import API_KEY
+
+logger = logging.getLogger(__name__)
+
+api_key_header = APIKeyHeader(name="X-API-Key", auto_error=False)
+
+async def verify_api_key(api_key: str = Security(api_key_header)):
+    if not API_KEY:
+        return True
+    if not api_key or api_key != API_KEY:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or missing API key",
+        )
+    return True

backend/config.py

@@ -5,6 +5,7 @@
 
 GOOGLE_MAPS_API_KEY = os.getenv("GOOGLE_MAPS_API_KEY", "")
 GOOGLE_SERVICE_ACCOUNT_JSON = os.getenv("GOOGLE_SERVICE_ACCOUNT_JSON", "")
+API_KEY = os.getenv("API_KEY", "")
 _db_url = os.getenv("DATABASE_URL", "postgresql+asyncpg://postgres:postgres@localhost:5432/leadforge")
 DATABASE_URL = _db_url.replace("postgresql://", "postgresql+asyncpg://", 1) if _db_url.startswith("postgresql://") and not _db_url.startswith("postgresql+asyncpg://") else _db_url
 MAX_RESULTS_PER_QUERY = 60

backend/main.py

@@ -1,30 +1,39 @@
 import logging
-from fastapi import FastAPI
+from fastapi import FastAPI, Depends
 from fastapi.middleware.cors import CORSMiddleware
 from contextlib import asynccontextmanager
+from slowapi import Limiter, _rate_limit_exceeded_handler
+from slowapi.util import get_remote_address
+from slowapi.errors import RateLimitExceeded
 from sqlalchemy import text
 from .database import init_db, async_session
 from .routers import search, leads, export
+from .auth import verify_api_key
 
 logger = logging.getLogger(__name__)
 
+limiter = Limiter(key_func=get_remote_address)
+
 @asynccontextmanager
 async def lifespan(app: FastAPI):
     await init_db()
     yield
 
 app = FastAPI(title="LeadForge", lifespan=lifespan)
 
+app.state.limiter = limiter
+app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
+
 app.add_middleware(
     CORSMiddleware,
     allow_origins=["*"],
     allow_methods=["*"],
     allow_headers=["*"],
 )
 
-app.include_router(search.router, prefix="/api", tags=["search"])
-app.include_router(leads.router, prefix="/api", tags=["leads"])
-app.include_router(export.router, prefix="/api", tags=["export"])
+app.include_router(search.router, prefix="/api", tags=["search"], dependencies=[Depends(verify_api_key)])
+app.include_router(leads.router, prefix="/api", tags=["leads"], dependencies=[Depends(verify_api_key)])
+app.include_router(export.router, prefix="/api", tags=["export"], dependencies=[Depends(verify_api_key)])
 
 @app.get("/api/health")
 async def health():

backend/requirements.txt

@@ -6,6 +6,9 @@ aiohttp==3.11.11
 google-auth==2.37.0
 google-api-python-client==2.159.0
 python-dotenv==1.0.1
-redis==5.2.1
-rq==2.1.0
 pydantic==2.10.4
+slowapi==0.1.9
+pytest==8.3.4
+pytest-asyncio==0.25.3
+httpx==0.28.1
+pytest-httpx==0.35.0

backend/routers/search.py

@@ -1,11 +1,14 @@
-from fastapi import APIRouter, Depends, BackgroundTasks, HTTPException
+from fastapi import APIRouter, Depends, BackgroundTasks, HTTPException, Request
 from pydantic import BaseModel, Field
 from sqlalchemy.ext.asyncio import AsyncSession
+from slowapi import Limiter
+from slowapi.util import get_remote_address
 from ..database import get_session
 from ..models.campaign import Campaign, CampaignStatus
 from ..workers.grid_search import run_grid_search
 
 router = APIRouter()
+limiter = Limiter(key_func=get_remote_address)
 
 class SearchRequest(BaseModel):
     query: str
@@ -16,8 +19,10 @@ class SearchRequest(BaseModel):
     min_rating: float | None = None
 
 @router.post("/search")
+@limiter.limit("5/minute")
 async def create_search(
     req: SearchRequest,
+    request: Request,
     background_tasks: BackgroundTasks,
     db: AsyncSession = Depends(get_session),
 ):

backend/tests/__init__.py

@@ -0,0 +1,78 @@
+import os
+import sys
+from unittest.mock import AsyncMock, MagicMock, patch
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", ".."))
+
+db_session_mock = MagicMock()
+db_session_mock.__aenter__.return_value = db_session_mock
+db_session_mock.__aexit__.return_value = None
+
+_async_session_patcher = patch("backend.database.async_session", return_value=db_session_mock)
+_get_session_patcher = patch("backend.database.get_session", return_value=db_session_mock)
+_init_db_patcher = patch("backend.database.init_db", return_value=None)
+
+_async_session_patcher.start()
+_get_session_patcher.start()
+_init_db_patcher.start()
+
+import pytest
+from fastapi import FastAPI, Depends
+from fastapi.middleware.cors import CORSMiddleware
+
+from backend.routers.search import router as search_router
+from backend.routers.leads import router as leads_router
+from backend.routers.export import router as export_router
+
+@pytest.fixture
+def app():
+    app = FastAPI(title="LeadForge-Test")
+
+    app.add_middleware(
+        CORSMiddleware,
+        allow_origins=["*"],
+        allow_methods=["*"],
+        allow_headers=["*"],
+    )
+
+    app.include_router(search_router, prefix="/api")
+    app.include_router(leads_router, prefix="/api")
+    app.include_router(export_router, prefix="/api")
+
+    @app.get("/api/health")
+    async def health():
+        return {"status": "ok", "database": "disconnected"}
+
+    return app
+
+@pytest.fixture
+def app_with_key():
+    os.environ["API_KEY"] = "test-key-123"
+
+    import importlib
+    import backend.config
+    importlib.reload(backend.config)
+
+    from backend.auth import verify_api_key
+
+    test_app = FastAPI(title="LeadForge-Test-Auth")
+
+    test_app.add_middleware(
+        CORSMiddleware,
+        allow_origins=["*"],
+        allow_methods=["*"],
+        allow_headers=["*"],
+    )
+
+    test_app.include_router(search_router, prefix="/api", dependencies=[Depends(verify_api_key)])
+    test_app.include_router(leads_router, prefix="/api", dependencies=[Depends(verify_api_key)])
+    test_app.include_router(export_router, prefix="/api", dependencies=[Depends(verify_api_key)])
+
+    @test_app.get("/api/health")
+    async def health():
+        return {"status": "ok", "database": "disconnected"}
+
+    yield test_app
+
+    del os.environ["API_KEY"]
+    importlib.reload(backend.config)