Restrict local API to loopback clients

SovereignAI-Starter/app/main.py

@@ -138,6 +138,25 @@ async def attach_request_id(request: Request, call_next: Any):
     """Give every response a server-generated correlation ID without logging content."""
     request_id = str(uuid4())
     request.state.request_id = request_id
+    client_host = request.client.host if request.client is not None else ""
+    try:
+        remote_client = not ipaddress.ip_address(client_host).is_loopback
+    except ValueError:
+        remote_client = True
+    if remote_client:
+        response = JSONResponse(
+            status_code=403,
+            content={
+                "error": {
+                    "code": "loopback_only",
+                    "message": "هذه النسخة المحلية تقبل الاتصالات من الجهاز نفسه فقط.",
+                },
+                "detail": "هذه النسخة المحلية تقبل الاتصالات من الجهاز نفسه فقط.",
+                "request_id": request_id,
+            },
+            headers={"X-Request-ID": request_id},
+        )
+        return response
     try:
         response = await call_next(request)
     except Exception: