yunchan/vignette
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Stabilize runtime auth and E2E coverage

Browse source
This commit is contained in:
Yun Chan 2026-06-26 14:47:00 +09:00
parent 6a3e3b541c
commit 188e899394
133 changed files with 55987 additions and 6775 deletions
Download patch file Download diff file Expand all files Collapse all files

25
infra/.env.example
View file

@ -1,12 +1,31 @@
# Vignette infra env (예시). cp .env.example .env 후 값 채우기
POSTGRES_USER=vignette
POSTGRES_USER=vignette_owner
ENVIRONMENT=prod
POSTGRES_USER=vignette_owner
POSTGRES_PASSWORD=change-me
POSTGRES_DB=vignette
APP_DB_USER=vignette_app
APP_DB_PASSWORD=change-me-app
SESSION_SECRET=change-me-random
AUTH_ALLOWED_EMAIL_DOMAINS=["hs.ac.kr","twentyoz.kr"]
AUTH_TEACHER_EMAILS=[]
AUTH_ADMIN_EMAILS=[]
AUTH_DEV_LOGIN_ENABLED=false
DEFAULT_AFFILIATION=
AUTO_SEED_PERSONAS=false
ALLOW_SEED_PERSONA_FALLBACK=false
EVALUATOR_GOLDEN_FEWSHOT_ENABLED=false
OAUTH_GOOGLE_CLIENT_ID=
OAUTH_GOOGLE_CLIENT_SECRET=
OAUTH_REDIRECT_URI=https://api-vignette.chanpaca.net/auth/callback
FRONTEND_BASE_URL=https://vignette.chanpaca.net
CORS_ORIGINS=["https://vignette.chanpaca.net","https://vignette-b1q.pages.dev"]
# For local-only compose development, set ENVIRONMENT=dev and add http://localhost:5173 to CORS_ORIGINS.
OPENAI_API_KEY=
OPENAI_BASE_URL=https://api.openai.com/v1
ANTHROPIC_API_KEY=
# 엔진(이식성): 네 PC=claude_p, 클라우드=messages_api
ENGINE_MODE=claude_p
# 엔진(이식성): 네 PC=claude_cli, 클라우드=claude_api
ENGINE_MODE=claude_cli
ENGINE_URL=http://host.docker.internal:9099
# 외부노출(비우면 로컬 :80)
SITE_ADDRESS=:80

13
infra/db/init/04_audit_eval_rls.sql
View file

@ -171,13 +171,24 @@ CREATE POLICY p_sessions_select ON app.sessions FOR SELECT USING (
AND u.cohort = current_setting('app.current_cohort', true)))
);
DROP POLICY IF EXISTS p_sessions_modify ON app.sessions;
CREATE POLICY p_sessions_modify ON app.sessions FOR ALL USING (
DROP POLICY IF EXISTS p_sessions_insert ON app.sessions;
DROP POLICY IF EXISTS p_sessions_update ON app.sessions;
DROP POLICY IF EXISTS p_sessions_delete ON app.sessions;
CREATE POLICY p_sessions_insert ON app.sessions FOR INSERT WITH CHECK (
app.is_ai_context() OR app.current_role_name() IN ('admin','instructor')
OR learner_id = app.current_uid()
);
CREATE POLICY p_sessions_update ON app.sessions FOR UPDATE USING (
app.is_ai_context() OR app.current_role_name() IN ('admin','instructor')
OR learner_id = app.current_uid()
) WITH CHECK (
app.is_ai_context() OR app.current_role_name() IN ('admin','instructor')
OR learner_id = app.current_uid()
);
CREATE POLICY p_sessions_delete ON app.sessions FOR DELETE USING (
app.is_ai_context() OR app.current_role_name() IN ('admin','instructor')
OR learner_id = app.current_uid()
);
-- ── turns: 세션 소유 + visible_to(레이어1) 동시 ──
ALTER TABLE app.turns ENABLE ROW LEVEL SECURITY;

125
infra/db/init/05_runtime_auth.sql Normal file
View file

@ -0,0 +1,125 @@
-- Runtime auth/session tables used by the BFF boundary.
-- This runs during DB initialization so the API can use a non-owner app role.
ALTER TABLE app.app_user
ADD COLUMN IF NOT EXISTS affiliation TEXT NOT NULL DEFAULT '',
ADD COLUMN IF NOT EXISTS last_seen_at TIMESTAMPTZ NOT NULL DEFAULT now(),
ADD COLUMN IF NOT EXISTS updated_at TIMESTAMPTZ NOT NULL DEFAULT now();
ALTER TABLE app.app_user
ALTER COLUMN affiliation SET DEFAULT '';
CREATE TABLE IF NOT EXISTS app.auth_session (
sid_hash TEXT PRIMARY KEY,
user_id UUID NOT NULL REFERENCES app.app_user(user_id) ON DELETE CASCADE,
role TEXT NOT NULL,
display_name TEXT NOT NULL,
cohort_ids JSONB NOT NULL DEFAULT '[]'::jsonb,
expires_at TIMESTAMPTZ NOT NULL,
revoked_at TIMESTAMPTZ,
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
last_seen_at TIMESTAMPTZ NOT NULL DEFAULT now()
);
CREATE INDEX IF NOT EXISTS idx_auth_session_user_active
ON app.auth_session(user_id, expires_at)
WHERE revoked_at IS NULL;
CREATE TABLE IF NOT EXISTS app.user_preferences (
user_id UUID PRIMARY KEY REFERENCES app.app_user(user_id) ON DELETE CASCADE,
theme TEXT NOT NULL DEFAULT 'system',
voice_preset_id TEXT NOT NULL DEFAULT 'soft-young-fem',
voice_rate REAL NOT NULL DEFAULT 1.0,
notifications JSONB NOT NULL DEFAULT '{}'::jsonb,
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
);
CREATE TABLE IF NOT EXISTS app.admin_engine_config (
id BOOLEAN PRIMARY KEY DEFAULT TRUE CHECK (id),
engine_mode TEXT NOT NULL,
engine_url TEXT NOT NULL,
model TEXT NOT NULL,
updated_by TEXT,
updated_at TIMESTAMPTZ
);
ALTER TABLE app.sessions
ADD COLUMN IF NOT EXISTS runtime_case_id UUID,
ADD COLUMN IF NOT EXISTS persona_code TEXT,
ADD COLUMN IF NOT EXISTS persona_display_name TEXT,
ADD COLUMN IF NOT EXISTS persona_difficulty TEXT,
ADD COLUMN IF NOT EXISTS prev_rapport_credit REAL NOT NULL DEFAULT 0.0;
ALTER TABLE app.session_state
ADD COLUMN IF NOT EXISTS turns_in_stage INT NOT NULL DEFAULT 0;
INSERT INTO app.stage_def (stage_code, display_name, seq, base_openness)
VALUES
('라포', '라포', 1, 0.15),
('탐색', '탐색', 2, 0.35),
('개입', '개입', 3, 0.55),
('정리', '정리', 4, 0.45)
ON CONFLICT (stage_code) DO UPDATE SET
display_name = EXCLUDED.display_name,
seq = EXCLUDED.seq,
base_openness = EXCLUDED.base_openness;
DROP POLICY IF EXISTS p_sessions_modify ON app.sessions;
DROP POLICY IF EXISTS p_sessions_insert ON app.sessions;
DROP POLICY IF EXISTS p_sessions_update ON app.sessions;
DROP POLICY IF EXISTS p_sessions_delete ON app.sessions;
CREATE POLICY p_sessions_insert ON app.sessions FOR INSERT WITH CHECK (
app.is_ai_context() OR app.current_role_name() IN ('admin','instructor')
OR learner_id = app.current_uid()
);
CREATE POLICY p_sessions_update ON app.sessions FOR UPDATE USING (
app.is_ai_context() OR app.current_role_name() IN ('admin','instructor')
OR learner_id = app.current_uid()
) WITH CHECK (
app.is_ai_context() OR app.current_role_name() IN ('admin','instructor')
OR learner_id = app.current_uid()
);
CREATE POLICY p_sessions_delete ON app.sessions FOR DELETE USING (
app.is_ai_context() OR app.current_role_name() IN ('admin','instructor')
OR learner_id = app.current_uid()
);
DROP POLICY IF EXISTS p_turns_modify ON app.turns;
DROP POLICY IF EXISTS p_turns_insert ON app.turns;
DROP POLICY IF EXISTS p_turns_update ON app.turns;
DROP POLICY IF EXISTS p_turns_delete ON app.turns;
CREATE POLICY p_turns_insert ON app.turns FOR INSERT WITH CHECK (
app.is_ai_context()
OR app.current_role_name() IN ('admin','instructor')
OR EXISTS (
SELECT 1 FROM app.sessions s
WHERE s.id = app.turns.session_id
AND s.learner_id = app.current_uid()
)
);
CREATE POLICY p_turns_update ON app.turns FOR UPDATE USING (
app.is_ai_context()
OR app.current_role_name() IN ('admin','instructor')
OR EXISTS (
SELECT 1 FROM app.sessions s
WHERE s.id = app.turns.session_id
AND s.learner_id = app.current_uid()
)
) WITH CHECK (
app.is_ai_context()
OR app.current_role_name() IN ('admin','instructor')
OR EXISTS (
SELECT 1 FROM app.sessions s
WHERE s.id = app.turns.session_id
AND s.learner_id = app.current_uid()
)
);
CREATE POLICY p_turns_delete ON app.turns FOR DELETE USING (
app.is_ai_context()
OR app.current_role_name() IN ('admin','instructor')
OR EXISTS (
SELECT 1 FROM app.sessions s
WHERE s.id = app.turns.session_id
AND s.learner_id = app.current_uid()
)
);

72
infra/db/init/06_session_evaluation.sql Normal file
View file

@ -0,0 +1,72 @@
-- Persist session-level evaluator output for learner reviews and teacher/admin views.
CREATE TABLE IF NOT EXISTS app.session_evaluation (
session_id UUID PRIMARY KEY REFERENCES app.sessions(id) ON DELETE CASCADE,
status TEXT NOT NULL CHECK (status IN ('ready','degraded','error')),
source TEXT NOT NULL,
scope TEXT NOT NULL,
stage TEXT NOT NULL,
payload JSONB NOT NULL DEFAULT '{}'::jsonb,
error TEXT,
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
);
ALTER TABLE app.session_evaluation ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS p_session_evaluation_select ON app.session_evaluation;
DROP POLICY IF EXISTS p_session_evaluation_insert ON app.session_evaluation;
DROP POLICY IF EXISTS p_session_evaluation_update ON app.session_evaluation;
DROP POLICY IF EXISTS p_session_evaluation_delete ON app.session_evaluation;
CREATE POLICY p_session_evaluation_select
ON app.session_evaluation FOR SELECT USING (
app.is_ai_context()
OR app.current_role_name() IN ('admin','instructor')
OR EXISTS (
SELECT 1 FROM app.sessions s
WHERE s.id = app.session_evaluation.session_id
AND s.learner_id = app.current_uid()
)
);
CREATE POLICY p_session_evaluation_insert
ON app.session_evaluation FOR INSERT WITH CHECK (
app.is_ai_context()
OR app.current_role_name() IN ('admin','instructor')
OR EXISTS (
SELECT 1 FROM app.sessions s
WHERE s.id = app.session_evaluation.session_id
AND s.learner_id = app.current_uid()
)
);
CREATE POLICY p_session_evaluation_update
ON app.session_evaluation FOR UPDATE USING (
app.is_ai_context()
OR app.current_role_name() IN ('admin','instructor')
OR EXISTS (
SELECT 1 FROM app.sessions s
WHERE s.id = app.session_evaluation.session_id
AND s.learner_id = app.current_uid()
)
) WITH CHECK (
app.is_ai_context()
OR app.current_role_name() IN ('admin','instructor')
OR EXISTS (
SELECT 1 FROM app.sessions s
WHERE s.id = app.session_evaluation.session_id
AND s.learner_id = app.current_uid()
)
);
CREATE POLICY p_session_evaluation_delete
ON app.session_evaluation FOR DELETE USING (
app.is_ai_context()
OR app.current_role_name() IN ('admin','instructor')
OR EXISTS (
SELECT 1 FROM app.sessions s
WHERE s.id = app.session_evaluation.session_id
AND s.learner_id = app.current_uid()
)
);

46
infra/db/init/99_app_role.sh Normal file
View file

@ -0,0 +1,46 @@
#!/usr/bin/env bash
set -e
APP_DB_USER="${APP_DB_USER:-vignette_app}"
APP_DB_PASSWORD="${APP_DB_PASSWORD:-vignette_app}"
case "$APP_DB_USER" in
*[!a-zA-Z0-9_]*)
echo "APP_DB_USER must contain only letters, numbers, and underscores" >&2
exit 1
;;
esac
if psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" -tAc "SELECT 1 FROM pg_roles WHERE rolname = '$APP_DB_USER'" | grep -q 1; then
psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
-v app_user="$APP_DB_USER" \
-v app_password="$APP_DB_PASSWORD" <<'EOSQL'
ALTER ROLE :"app_user" WITH LOGIN PASSWORD :'app_password' NOBYPASSRLS;
EOSQL
else
psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
-v app_user="$APP_DB_USER" \
-v app_password="$APP_DB_PASSWORD" <<'EOSQL'
CREATE ROLE :"app_user" WITH LOGIN PASSWORD :'app_password' NOBYPASSRLS;
EOSQL
fi
psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
-v app_user="$APP_DB_USER" \
-v db_name="$POSTGRES_DB" <<'EOSQL'
GRANT CONNECT ON DATABASE :"db_name" TO :"app_user";
GRANT USAGE ON SCHEMA app, kb, audit, ds TO :"app_user";
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA app, kb, audit, ds TO :"app_user";
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA app, kb, audit, ds TO :"app_user";
GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA app TO :"app_user";
ALTER DEFAULT PRIVILEGES IN SCHEMA app GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO :"app_user";
ALTER DEFAULT PRIVILEGES IN SCHEMA kb GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO :"app_user";
ALTER DEFAULT PRIVILEGES IN SCHEMA audit GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO :"app_user";
ALTER DEFAULT PRIVILEGES IN SCHEMA ds GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO :"app_user";
ALTER DEFAULT PRIVILEGES IN SCHEMA app GRANT USAGE, SELECT ON SEQUENCES TO :"app_user";
ALTER DEFAULT PRIVILEGES IN SCHEMA kb GRANT USAGE, SELECT ON SEQUENCES TO :"app_user";
ALTER DEFAULT PRIVILEGES IN SCHEMA audit GRANT USAGE, SELECT ON SEQUENCES TO :"app_user";
ALTER DEFAULT PRIVILEGES IN SCHEMA ds GRANT USAGE, SELECT ON SEQUENCES TO :"app_user";
ALTER DEFAULT PRIVILEGES IN SCHEMA app GRANT EXECUTE ON FUNCTIONS TO :"app_user";
EOSQL

51
infra/docker-compose.yml
View file

@ -1,12 +1,3 @@
# Vignette — 이식 가능한 단일 호스트 배포 구성
# 어디서든: cp .env.example .env && (값 채우고) && docker compose up -d
#
# 설계 원칙:
# - web/api/db/voice/rag 는 전부 컨테이너 → 호스트 무관하게 한 방에 뜬다.
# - "엔진"(로컬 claude -p)만 컨테이너 밖. api 는 ENGINE_URL 로 가리킨다.
# → 옮길 때 ENGINE_URL 한 줄만 바꾸면 됨(로컬 게이트웨이 ↔ API 폴백).
# - 시크릿/엔드포인트는 전부 .env. 이미지에 굽지 않는다(이식성).
name: vignette
services:
@ -14,14 +5,16 @@ services:
image: pgvector/pgvector:pg16
restart: unless-stopped
environment:
POSTGRES_USER: ${POSTGRES_USER:-vignette}
POSTGRES_USER: ${POSTGRES_USER:-vignette_owner}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set in .env}
POSTGRES_DB: ${POSTGRES_DB:-vignette}
APP_DB_USER: ${APP_DB_USER:-vignette_app}
APP_DB_PASSWORD: ${APP_DB_PASSWORD:?set in .env}
volumes:
- pgdata:/var/lib/postgresql/data
- ./db/init:/docker-entrypoint-initdb.d:ro # 스키마/확장 초기화 SQL
- ./db/init:/docker-entrypoint-initdb.d:ro
healthcheck:
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-vignette}"]
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-vignette_owner}"]
interval: 10s
timeout: 5s
retries: 5
@ -35,20 +28,32 @@ services:
depends_on:
db: { condition: service_healthy }
environment:
DATABASE_URL: postgresql://${POSTGRES_USER:-vignette}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-vignette}
# === 엔진(이식성 핵심) ===
# 로컬 운영: host 의 claude -p 게이트웨이를 가리킴(아래 extra_hosts 사용)
# 클라우드 이전: 이 값을 Messages API 어댑터 URL 로만 바꾸면 됨.
ENVIRONMENT: ${ENVIRONMENT:?set ENVIRONMENT in .env}
DATABASE_URL: postgresql://${APP_DB_USER:-vignette_app}:${APP_DB_PASSWORD}@db:5432/${POSTGRES_DB:-vignette}
ENGINE_URL: ${ENGINE_URL:-http://host.docker.internal:9099}
ENGINE_MODE: ${ENGINE_MODE:-claude_p} # claude_p | messages_api
ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-} # 폴백/클라우드용
OPENAI_API_KEY: ${OPENAI_API_KEY:?set in .env} # 음성
ENGINE_MODE: ${ENGINE_MODE:-claude_cli}
ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
OPENAI_API_KEY: ${OPENAI_API_KEY:?set in .env}
OPENAI_BASE_URL: ${OPENAI_BASE_URL:-https://api.openai.com/v1}
RAG_EMBED_URL: http://rag:8080
SESSION_SECRET: ${SESSION_SECRET:?set in .env}
OAUTH_GOOGLE_CLIENT_ID: ${OAUTH_GOOGLE_CLIENT_ID:?set in .env}
OAUTH_GOOGLE_CLIENT_SECRET: ${OAUTH_GOOGLE_CLIENT_SECRET:?set in .env}
OAUTH_REDIRECT_URI: ${OAUTH_REDIRECT_URI:-https://api-vignette.chanpaca.net/auth/callback}
AUTH_ALLOWED_EMAIL_DOMAINS: '${AUTH_ALLOWED_EMAIL_DOMAINS:-["hs.ac.kr","twentyoz.kr"]}'
AUTH_TEACHER_EMAILS: '${AUTH_TEACHER_EMAILS:-[]}'
AUTH_ADMIN_EMAILS: '${AUTH_ADMIN_EMAILS:-[]}'
AUTH_DEV_LOGIN_ENABLED: ${AUTH_DEV_LOGIN_ENABLED:-false}
DEFAULT_AFFILIATION: ${DEFAULT_AFFILIATION:-}
AUTO_SEED_PERSONAS: ${AUTO_SEED_PERSONAS:-false}
ALLOW_SEED_PERSONA_FALLBACK: ${ALLOW_SEED_PERSONA_FALLBACK:-false}
EVALUATOR_GOLDEN_FEWSHOT_ENABLED: ${EVALUATOR_GOLDEN_FEWSHOT_ENABLED:-false}
FRONTEND_BASE_URL: ${FRONTEND_BASE_URL:-https://vignette.chanpaca.net}
CORS_ORIGINS: '${CORS_ORIGINS:-["https://vignette.chanpaca.net","https://vignette-b1q.pages.dev"]}'
extra_hosts:
- "host.docker.internal:host-gateway" # 컨테이너→호스트 엔진 게이트웨이 접근(Linux 포함)
- "host.docker.internal:host-gateway"
healthcheck:
test: ["CMD", "python", "-c", "import urllib.request,sys; urllib.request.urlopen('http://localhost:8000/health'); "]
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
interval: 15s
timeout: 5s
retries: 5
@ -64,7 +69,6 @@ services:
depends_on: [api]
networks: [vignette]
# RAG 사이드카: BGE-M3 임베딩 + BGE-reranker-v2-m3 (CPU 가능, GPU 있으면 가속)
rag:
build:
context: ../apps/api
@ -74,10 +78,9 @@ services:
EMBED_MODEL: BAAI/bge-m3
RERANK_MODEL: BAAI/bge-reranker-v2-m3
volumes:
- ragmodels:/models # 모델 캐시(재다운로드 방지 = 이식 시 볼륨만 옮기면 빠름)
- ragmodels:/models
networks: [vignette]
# 리버스프록시 + TLS. 외부노출(chanpaca.net)도 여기서. 끄려면 profiles 로 제외.
proxy:
image: caddy:2-alpine
restart: unless-stopped