Update app.py

app.py

@@ -26,15 +26,18 @@ logger = logging.getLogger("maria_pt")
 # ─────────────────────────────────────────────
 # Environment / Secrets  (set in HF Space Settings → Secrets)
 # ─────────────────────────────────────────────
-EXPECTED_HASH      = os.environ.get("EXPECTED_HASH",
-                       "7208839b7c5d8e5418a492ee2eadaf15d9d32ba7f7c9a4c0f0486cfc358a96c2")
-MONGO_PASSWORD     = os.environ.get("MONGO_PASSWORD", "")
-MONGO_URI          = os.environ.get(
-    "MONGO_URI",
-    f"mongodb+srv://testuser:{MONGO_PASSWORD}@cluster0.ntz2mpi.mongodb.net/"
-)
-MONGO_DB           = os.environ.get("MONGO_DB",   "MariaPTDB")
-MONGO_COLLECTION   = os.environ.get("MONGO_COLL", "MariaPTColl")
+def _require_secret(key: str) -> str:
+    value = os.environ.get(key)
+    if not value:
+        raise RuntimeError(f"Missing required secret: {key}")
+    return value
+
+EXPECTED_HASH    = _require_secret("EXPECTED_HASH")
+MONGO_PASSWORD   = _require_secret("MONGO_PASSWORD")
+MONGO_DB         = os.environ.get("MONGO_DB",   "MariaPTDB")
+MONGO_COLLECTION = os.environ.get("MONGO_COLL", "MariaPTColl")
+MONGO_URI        = os.environ.get("MONGO_URI") or \
+                   f"mongodb+srv://testuser:{MONGO_PASSWORD}@cluster0.ntz2mpi.mongodb.net/"
 
 # Cloudflare Turnstile secret (placeholder – paste your real secret in HF Secrets)
 CF_TURNSTILE_SECRET = os.environ.get("CF_TURNSTILE_SECRET", "PLACEHOLDER_CF_TURNSTILE_SECRET")