AI-written code accepted refresh tokens via URL query parameters in /refresh endpoints, leaking them in HTTP logs, browser history, and Referer headers.

+Unified FastAPI server for Keyserver and Telemetry modules.+"""++import logging+from contextlib import asynccontextmanager++from fastapi import FastAPI+from fastapi.middleware.cors import CORSMiddleware+import uvicorn++from .config import Settings, settings, validate_config+from .core.database import close_db, init_db, init_engine+from .core.exceptions import ServerException, server_exception_handler+from .modules import load_modules++# Configure logging+logging.basicConfig(+    level=getattr(logging, settings.log_level.upper()),+    format="%(asctime)s - %(name)s - %(levelname)s - %(message)s",+)++logger = logging.getLogger(__name__)+++@asynccontextmanager+async def lifespan(app: FastAPI):+    """+    Lifespan event handler for FastAPI.++    Runs on startup and shutdown.+    """+    # Startup+    logger.info("=" * 60)+    logger.info(f"Starting {settings.app_name}...")+    logger.info(f"Version: {settings.version}")+    logger.info(f"Debug mode: {settings.debug}")+    logger.info("=" * 60)++    # Validate configuration+    try:+        validate_config(settings)+        logger.info("Configuration validated successfully")+    except ValueError as e:+        logger.error(f"Configuration error: {e}")+        raise++    # Import all models (must be done before init_db)+    if settings.keyserver_enabled:+        from .modules.keyserver import models as ks_models  # noqa: F401+    if settings.telemetry_enabled:+        from .modules.telemetry import models as tm_models  # noqa: F401++    # Initialize database+    try:+        database_url = settings.get_database_url()+        init_engine(database_url)+        await init_db()+        logger.info("Database initialized successfully")+    except Exception as e:+        logger.error(f"Failed to initialize database: {e}")+        raise++    # Check if liboqs is available+    try:+        import oqs++        logger.info("liboqs is available - PQC signature verification enabled")+    except ImportError:+        logger.warning(+            "liboqs not available - keyserver signature verification will fail. "+            "Install with: pip install liboqs-python"+        )++    # Load enabled modules+    try:+        loaded_modules = load_modules(app, settings)+        logger.info(f"Loaded modules: {', '.join(loaded_modules)}")+    except Exception as e:+        logger.error(f"Failed to load modules: {e}")+        raise++    logger.info("=" * 60)+    logger.info(f"Server started on {settings.server_host}:{settings.server_port}")+    logger.info("=" * 60)+

++Request/response validation for telemetry endpoints.+"""++from datetime import datetime+from typing import Dict, List, Optional++from pydantic import BaseModel, Field+++class RegisterResponse(BaseModel):+    """Response for client registration"""++    client_id: str+    token: str+    expires_at: str  # ISO 8601 datetime+    token_type: str = "Bearer"+++class TelemetryEventSchema(BaseModel):+    """Single telemetry event"""++    timestamp: str = Field(..., description="Event timestamp (ISO 8601)")+    operation: str = Field(..., description="Operation: encrypt or decrypt")+    mode: str = Field(..., description="Mode: symmetric or asymmetric")+    format_version: int = Field(..., description="File format version (4-8)")++    hash_algorithms: List[str] = Field(..., description="Hash algorithms used")+    kdf_algorithms: List[str] = Field(..., description="KDF algorithms used")+    kdf_parameters: Optional[Dict[str, Dict[str, int]]] = Field(+        default=None, description="KDF parameters"+    )++    encryption_algorithm: str = Field(..., description="Encryption algorithm")++    cascade_enabled: bool = Field(default=False, description="Cascade encryption enabled")+    cascade_cipher_count: Optional[int] = Field(+        default=None, description="Number of cascade ciphers"+    )++    pqc_kem_algorithm: Optional[str] = Field(default=None, description="PQC KEM algorithm")+    pqc_signing_algorithm: Optional[str] = Field(+        default=None, description="PQC signing algorithm"+    )++    hsm_plugin_used: Optional[str] = Field(default=None, description="HSM plugin name")++    success: bool = Field(default=True, description="Operation success")+    error_category: Optional[str] = Field(default=None, description="Error category if failed")+++class TelemetryBatchRequest(BaseModel):+    """Batch telemetry upload request"""++    events: List[TelemetryEventSchema] = Field(+        ..., min_length=1, max_length=1000, description="List of telemetry events (max 1000)"

+    processed: int = Field(..., description="Number of events successfully processed")+++class StatsResponse(BaseModel):+    """Public statistics response"""++    total_operations: int+    total_clients: int+    algorithms: Dict[str, int]+    operations: Dict[str, int]+    success_rate: float+++class ErrorResponse(BaseModel):+    """Standard error response"""++    detail: str+    success: bool = False

++Endpoints:+- POST /api/v1/telemetry/register - Register new client (no auth)+- POST /api/v1/telemetry/events - Submit events (auth required)+- GET /api/v1/telemetry/stats - Get public statistics (no auth)+"""+

+from .auth import get_telemetry_auth+from .schemas import (+    ErrorResponse,

+logger = logging.getLogger(__name__)++router = APIRouter(prefix="/api/v1/telemetry", tags=["telemetry"])++security = HTTPBearer()++

+    payload = auth.verify_token(credentials.credentials)++    # Update last seen (fire and forget)+    try:+        await auth.update_last_seen(payload.sub)+    except Exception:+        pass++    return payload.sub++

+    """+    Register a new Telemetry client.++    Returns a JWT token that can ONLY be used for Telemetry endpoints.+    The token includes an issuer claim that prevents cross-module usage.++    Returns:+        RegisterResponse: Client ID, JWT token, expiration+    """+    auth = get_telemetry_auth()+    return await auth.register_client()+

+    },+    summary="Submit telemetry events",+)+async def submit_events(+    request: TelemetryBatchRequest,+    db: AsyncSession = Depends(get_db),+    client_id: str = Depends(get_current_client),+):+    """+    Submit telemetry events.

@@ -76,6 +77,12 @@ async def register(request: Request):

++ @router.post(     "/refresh",     response_model=RegisterResponse,@@ -88,31 +95,31 @@ async def register(request: Request): @limiter.limit("60/hour")

      SECURITY:-    - Requires valid refresh token (7-day expiry)+    - Requires valid refresh token (7-day expiry) in POST body (not query params)     - Returns new token pair with extended expiration     - Implements sliding expiration: tokens auto-extend on use within TTL      Token Flow:     1. Client uses access token (1-hour expiry) for API calls-    2. Before access token expires, client uses refresh token+    2. Before access token expires, client sends refresh token in POST body     3. Server returns NEW access token (1 hour) + NEW refresh token (7 days)     4. This provides sliding expiration - active clients never locked out 

     """     auth = get_telemetry_auth()-    result = auth.refresh_access_token(refresh_token)+    result = auth.refresh_access_token(body.refresh_token)      return RegisterResponse(         client_id=result["client_id"],