Stabilize runtime auth and E2E coverage

apps/api/app/config.py

@@ -8,8 +8,9 @@ from __future__ import annotations
 
 from functools import lru_cache
 from typing import Literal
+from urllib.parse import urlsplit
 
-from pydantic import Field
+from pydantic import Field, model_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 # 엔진 어댑터 provider 플래그 (마스터플랜 §0, R1: claude -p 과금누수 회피)
@@ -20,12 +21,19 @@ from pydantic_settings import BaseSettings, SettingsConfigDict
 EngineMode = Literal["claude_api", "claude_cli", "openai", "solar"]
 
 
+def _is_local_url(value: str) -> bool:
+    parsed = urlsplit(value)
+    host = (parsed.hostname or "").lower()
+    return host in {"localhost", "127.0.0.1", "::1"}
+
+
 class Settings(BaseSettings):
     model_config = SettingsConfigDict(
         env_file=".env",
         env_file_encoding="utf-8",
         extra="ignore",
         case_sensitive=False,
+        populate_by_name=True,
     )
 
     # ── 앱 ───────────────────────────────────────────────
@@ -59,6 +67,10 @@ class Settings(BaseSettings):
     # ── 외부 LLM 키 (게이트웨이가 못 받을 때 직접 폴백, PII 마스킹 후만) ──
     anthropic_api_key: str = Field(default="", validation_alias="ANTHROPIC_API_KEY")
     openai_api_key: str = Field(default="", validation_alias="OPENAI_API_KEY")
+    openai_base_url: str = Field(
+        default="https://api.openai.com/v1",
+        validation_alias="OPENAI_BASE_URL",
+    )
 
     # ── 세션/인증 (BFF OAuth 2.1, 토큰 서버 보관) ────────
     session_secret: str = Field(
@@ -75,16 +87,54 @@ class Settings(BaseSettings):
         default="", validation_alias="OAUTH_GOOGLE_CLIENT_SECRET"
     )
     oauth_redirect_uri: str = Field(
-        default="https://chanpaca.net/auth/callback",
+        default="https://api-vignette.chanpaca.net/auth/callback",
         validation_alias="OAUTH_REDIRECT_URI",
     )
+    auth_allowed_email_domains: list[str] = Field(
+        default=["hs.ac.kr", "twentyoz.kr"],
+        validation_alias="AUTH_ALLOWED_EMAIL_DOMAINS",
+    )
+    auth_teacher_emails: list[str] = Field(
+        default=[],
+        validation_alias="AUTH_TEACHER_EMAILS",
+    )
+    auth_admin_emails: list[str] = Field(
+        default=[],
+        validation_alias="AUTH_ADMIN_EMAILS",
+    )
+    auth_dev_login_enabled: bool = Field(
+        default=False,
+        validation_alias="AUTH_DEV_LOGIN_ENABLED",
+    )
+    default_affiliation: str = Field(
+        default="",
+        validation_alias="DEFAULT_AFFILIATION",
+    )
+    frontend_base_url: str = Field(
+        default="http://localhost:5173",
+        validation_alias="FRONTEND_BASE_URL",
+    )
 
     # ── CORS (정적 프론트 + SSE 분리경로) ────────────────
     cors_origins: list[str] = Field(
-        default=["https://chanpaca.net", "https://stream.chanpaca.net", "http://localhost:5173"],
+        default=[
+            "https://vignette.chanpaca.net",
+            "https://vignette-b1q.pages.dev",
+        ],
         validation_alias="CORS_ORIGINS",
     )
 
+    # Built-in personas are developer/bootstrap fixtures, not runtime truth.
+    # Production should use approved rows from app.persona_card only.
+    auto_seed_personas: bool = Field(
+        default=False,
+        validation_alias="AUTO_SEED_PERSONAS",
+    )
+    allow_seed_persona_fallback: bool = Field(
+        default=False,
+        validation_alias="ALLOW_SEED_PERSONA_FALLBACK",
+    )
+
     # ── SSE 스트리밍 ─────────────────────────────────────
     sse_heartbeat_seconds: int = 30  # Cloudflare 100초 timeout 회피 (R2)
 
@@ -92,6 +142,31 @@ class Settings(BaseSettings):
     def is_prod(self) -> bool:
         return self.environment == "prod"
 
+    @model_validator(mode="after")
+    def validate_non_dev_runtime_flags(self) -> "Settings":
+        if self.environment != "dev":
+            forbidden: list[str] = []
+            if self.auth_dev_login_enabled:
+                forbidden.append("AUTH_DEV_LOGIN_ENABLED")
+            if self.auto_seed_personas:
+                forbidden.append("AUTO_SEED_PERSONAS")
+            if self.allow_seed_persona_fallback:
+                forbidden.append("ALLOW_SEED_PERSONA_FALLBACK")
+            if not self.oauth_google_client_id.strip():
+                forbidden.append("OAUTH_GOOGLE_CLIENT_ID")
+            if not self.oauth_google_client_secret.strip():
+                forbidden.append("OAUTH_GOOGLE_CLIENT_SECRET")
+            if self.session_secret == "dev-insecure-change-me":
+                forbidden.append("SESSION_SECRET")
+            if _is_local_url(self.frontend_base_url):
+                forbidden.append("FRONTEND_BASE_URL")
+            if any(_is_local_url(origin) for origin in self.cors_origins):
+                forbidden.append("CORS_ORIGINS")
+            if forbidden:
+                joined = ", ".join(forbidden)
+                raise ValueError(f"{joined} must be production-safe when ENVIRONMENT={self.environment}")
+        return self
+
 
 @lru_cache
 def get_settings() -> Settings: