# Security Architecture: Protection of Private Data (7.8.'26 13:22 Fri)

The source code of `service_api.py` implements a triple-layered, mutually independent security architecture to protect private data.

## Overview

| Layer | Mechanism | Component | Protection Goal |
|-------|-----------|-----------|-----------------|
| 1 | Underscore-Rule Middleware | `service_api.py` | Block access to hidden paths |
| 2 | API-Key Authentication | `service_api.py` | Access control for endpoints |
| 3 | Privacy Masking & Cache Isolation | `service_api.py`, `aura_cache.py` | Data obfuscation & cache separation |

---

## Layer 1: Underscore-Rule Middleware

Any request to paths or folders with a leading underscore (such as `_privat`) is hard-blocked by the middleware with **HTTP 403 Forbidden**.

**Error message:**
```
Access to hidden folders (starting with '_') is forbidden.
```

This rule operates at the path/routing level and prevents any access to directories marked as private.

---

## Layer 2: API-Key Authentication

All API endpoints are protected by `Depends(verify_api_key)`.

Requests without a valid `X-API-Key` header are immediately rejected before reaching any business logic.

---

## Layer 3: Privacy Masking & Cache Isolation

### Masking
Via the API, `unmasked = False` is the default. Sensitive data in API responses is therefore automatically masked.

### Cache Isolation
The `cache_id` hash in `aura_cache.py` is separated by the active window title (`_active_window_title`).

**Consequence:** Cache entries created in the local terminal cannot be read via the API, because they possess a different `cache_id` hash.

---

## Summary

Your confidential data in `_privat` is thus protected on all three language and path levels against unauthorized API access:

1. **Path Level** — Access to `_` folders is blocked
2. **Authentication Level** — Only valid API keys are granted access
3. **Data Level** — Masking and cache isolation prevent data exfiltration