vignette/apps/api/app/config.py

"""환경설정 (env -> 타입드 Settings).

마스터플랜 §1.1 원칙: 엔진/DB/음성 엔드포인트는 전부 env 주입(이미지에 굽지 않음 = 이식성).
Docker Compose secrets/.env 로 주입, 코드에 하드코딩 금지.
"""

from __future__ import annotations

from functools import lru_cache
from typing import Literal
from urllib.parse import urlsplit

from pydantic import Field, model_validator
from pydantic_settings import BaseSettings, SettingsConfigDict

# 엔진 어댑터 provider 플래그 (마스터플랜 §0, R1: claude -p 과금누수 회피)
#  claude_api = Anthropic Messages API 직결 (기본)
#  claude_cli = 로컬 claude -p 상주풀 (stream-json, 옵션/시연용)
#  openai     = OpenAI 호환 (폴백/평가 보조)
#  solar      = 국내 모델 라우팅 (PII 민감구간 inference_geo:kr)
EngineMode = Literal["claude_api", "claude_cli", "openai", "solar"]


def _is_local_url(value: str) -> bool:
    parsed = urlsplit(value)
    host = (parsed.hostname or "").lower()
    return host in {"localhost", "127.0.0.1", "::1"}


def _is_allowed_local_dev_cors_origin(value: str) -> bool:
    parsed = urlsplit(value)
    host = (parsed.hostname or "").lower()
    return (
        parsed.scheme == "http"
        and host in {"localhost", "127.0.0.1"}
        and parsed.port in range(5170, 5181)
        and not parsed.path
        and not parsed.query
        and not parsed.fragment
    )


class Settings(BaseSettings):
    model_config = SettingsConfigDict(
        env_file=".env",
        env_file_encoding="utf-8",
        extra="ignore",
        case_sensitive=False,
        populate_by_name=True,
    )

    # ── 앱 ───────────────────────────────────────────────
    app_name: str = "vignette-api"
    environment: Literal["dev", "staging", "prod"] = "dev"
    debug: bool = False

    # ── DB (NAS PostgreSQL 16 + pgvector, 단일 SoR) ─────
    # 예: postgresql://user:pass@nas:5432/vignette
    database_url: str = Field(
        default="postgresql://user:pass@localhost:5432/vignette",
        validation_alias="DATABASE_URL",
    )
    db_pool_min_size: int = 2
    db_pool_max_size: int = 10
    db_command_timeout: float = 30.0

    # ── 엔진 게이트웨이 (람다 소유, 이 앱은 HTTP 호출만) ──
    # engine_gateway/ 서비스 베이스 URL. 게이트웨이가 provider 라우팅을 흡수.
    engine_url: str = Field(
        default="http://engine:8100",
        validation_alias="ENGINE_URL",
    )
    engine_mode: EngineMode = Field(
        default="claude_api",
        validation_alias="ENGINE_MODE",
    )
    engine_timeout: float = 120.0  # SSE 롱리브드 (50분 상담 대비, 스트림은 무제한 별도)
    engine_connect_timeout: float = 10.0

    # ── 외부 LLM 키 (게이트웨이가 못 받을 때 직접 폴백, PII 마스킹 후만) ──
    anthropic_api_key: str = Field(default="", validation_alias="ANTHROPIC_API_KEY")
    openai_api_key: str = Field(default="", validation_alias="OPENAI_API_KEY")
    openai_base_url: str = Field(
        default="https://api.openai.com/v1",
        validation_alias="OPENAI_BASE_URL",
    )

    # ── 세션/인증 (BFF OAuth 2.1, 토큰 서버 보관) ────────
    session_secret: str = Field(
        default="dev-insecure-change-me",
        validation_alias="SESSION_SECRET",
    )
    # __Host- 쿠키 정책: prod 에선 secure=True 강제
    cookie_name: str = "__Host-vignette_sid"
    session_ttl_seconds: int = 60 * 60 * 8  # 8h

    # Google OIDC (1차, 한신대 SSO 는 2차 — R11)
    oauth_google_client_id: str = Field(default="", validation_alias="OAUTH_GOOGLE_CLIENT_ID")
    oauth_google_client_secret: str = Field(
        default="", validation_alias="OAUTH_GOOGLE_CLIENT_SECRET"
    )
    oauth_redirect_uri: str = Field(
        default="https://api-vignette.chanpaca.net/auth/callback",
        validation_alias="OAUTH_REDIRECT_URI",
    )
    auth_allowed_email_domains: list[str] = Field(
        default=["hs.ac.kr", "twentyoz.kr"],
        validation_alias="AUTH_ALLOWED_EMAIL_DOMAINS",
    )
    auth_teacher_emails: list[str] = Field(
        default=[],
        validation_alias="AUTH_TEACHER_EMAILS",
    )
    auth_admin_emails: list[str] = Field(
        default=[],
        validation_alias="AUTH_ADMIN_EMAILS",
    )
    auth_dev_login_enabled: bool = Field(
        default=False,
        validation_alias="AUTH_DEV_LOGIN_ENABLED",
    )
    auth_saml_enabled: bool = Field(
        default=False,
        validation_alias="AUTH_SAML_ENABLED",
    )
    saml_sp_entity_id: str = Field(
        default="",
        validation_alias="SAML_SP_ENTITY_ID",
    )
    saml_sso_url: str = Field(
        default="",
        validation_alias="SAML_SSO_URL",
    )
    saml_x509_cert_fingerprint: str = Field(
        default="",
        validation_alias="SAML_X509_CERT_FINGERPRINT",
    )
    default_affiliation: str = Field(
        default="",
        validation_alias="DEFAULT_AFFILIATION",
    )
    frontend_base_url: str = Field(
        default="http://localhost:5173",
        validation_alias="FRONTEND_BASE_URL",
    )

    # ── CORS (정적 프론트 + SSE 분리경로) ────────────────
    cors_origins: list[str] = Field(
        default=[
            "https://vignette.chanpaca.net",
            "https://vignette-b1q.pages.dev",
        ],
        validation_alias="CORS_ORIGINS",
    )

    # Built-in personas are developer/bootstrap fixtures, not runtime truth.
    # Production should use approved rows from app.persona_card only.
    auto_seed_personas: bool = Field(
        default=False,
        validation_alias="AUTO_SEED_PERSONAS",
    )
    allow_seed_persona_fallback: bool = Field(
        default=False,
        validation_alias="ALLOW_SEED_PERSONA_FALLBACK",
    )

    # ── SSE 스트리밍 ─────────────────────────────────────
    sse_heartbeat_seconds: int = 30  # Cloudflare 100초 timeout 회피 (R2)

    @property
    def is_prod(self) -> bool:
        return self.environment == "prod"

    @model_validator(mode="after")
    def validate_non_dev_runtime_flags(self) -> "Settings":
        if self.environment != "dev":
            forbidden: list[str] = []
            if self.auth_dev_login_enabled:
                forbidden.append("AUTH_DEV_LOGIN_ENABLED")
            if self.auto_seed_personas:
                forbidden.append("AUTO_SEED_PERSONAS")
            if self.allow_seed_persona_fallback:
                forbidden.append("ALLOW_SEED_PERSONA_FALLBACK")
            if not self.oauth_google_client_id.strip():
                forbidden.append("OAUTH_GOOGLE_CLIENT_ID")
            if not self.oauth_google_client_secret.strip():
                forbidden.append("OAUTH_GOOGLE_CLIENT_SECRET")
            if self.session_secret == "dev-insecure-change-me":
                forbidden.append("SESSION_SECRET")
            if _is_local_url(self.frontend_base_url):
                forbidden.append("FRONTEND_BASE_URL")
            if any(
                _is_local_url(origin) and not _is_allowed_local_dev_cors_origin(origin)
                for origin in self.cors_origins
            ):
                forbidden.append("CORS_ORIGINS")
            if forbidden:
                joined = ", ".join(forbidden)
                raise ValueError(f"{joined} must be production-safe when ENVIRONMENT={self.environment}")
        if self.auth_saml_enabled:
            missing_saml: list[str] = []
            if not self.saml_sp_entity_id.strip():
                missing_saml.append("SAML_SP_ENTITY_ID")
            if not self.saml_sso_url.strip():
                missing_saml.append("SAML_SSO_URL")
            if missing_saml:
                joined = ", ".join(missing_saml)
                raise ValueError(f"{joined} must be configured when AUTH_SAML_ENABLED=true")
        return self


@lru_cache
def get_settings() -> Settings:
    """프로세스 1회 로드 (lru_cache). 의존성 주입은 deps.get_settings_dep 사용."""
    return Settings()


settings = get_settings()