yunchan/vignette
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
vignette/apps/api/app/config.py

266 lines
9.8 KiB
Python
Raw Blame History

"""환경설정 (env -> 타입드 Settings).
마스터플랜 §1.1 원칙: 엔진/DB/음성 엔드포인트는 전부 env 주입(이미지에 굽지 않음 = 이식성).
Docker Compose secrets/.env 로 주입, 코드에 하드코딩 금지.
"""
from __future__ import annotations
from functools import lru_cache
from typing import Literal
from urllib.parse import urlsplit
from pydantic import Field, model_validator
from pydantic_settings import BaseSettings, SettingsConfigDict
# 엔진 어댑터 provider 플래그 (마스터플랜 §0, R1: claude -p 과금누수 회피)
# claude_api = Anthropic Messages API 직결 (기본)
# claude_cli = 로컬 claude -p 상주풀 (stream-json, 옵션/시연용)
# openai = OpenAI 호환 (폴백/평가 보조)
# solar = 국내 모델 라우팅 (PII 민감구간 inference_geo:kr)
EngineMode = Literal["claude_api", "claude_cli", "openai", "solar"]
def _is_local_url(value: str) -> bool:
parsed = urlsplit(value)
host = (parsed.hostname or "").lower()
return host in {"localhost", "127.0.0.1", "::1"}
def _is_allowed_local_dev_cors_origin(value: str) -> bool:
parsed = urlsplit(value)
host = (parsed.hostname or "").lower()
return (
parsed.scheme == "http"
and host in {"localhost", "127.0.0.1"}
and parsed.port in range(5170, 5181)
and not parsed.path
and not parsed.query
and not parsed.fragment
)
def _is_local_or_forbidden_non_dev_origin(value: str) -> bool:
return _is_local_url(value) and not _is_allowed_local_dev_cors_origin(value)
class Settings(BaseSettings):
model_config = SettingsConfigDict(
env_file=".env",
env_file_encoding="utf-8",
extra="ignore",
case_sensitive=False,
populate_by_name=True,
)
# ── 앱 ───────────────────────────────────────────────
app_name: str = "vignette-api"
environment: Literal["dev", "staging", "prod"] = "dev"
debug: bool = False
# ── DB (NAS PostgreSQL 16 + pgvector, 단일 SoR) ─────
# 예: postgresql://user:pass@nas:5432/vignette
database_url: str = Field(
default="postgresql://user:pass@localhost:5432/vignette",
validation_alias="DATABASE_URL",
)
db_pool_min_size: int = 2
db_pool_max_size: int = 10
db_command_timeout: float = 30.0
# ── 엔진 게이트웨이 (람다 소유, 이 앱은 HTTP 호출만) ──
# engine_gateway/ 서비스 베이스 URL. 게이트웨이가 provider 라우팅을 흡수.
engine_url: str = Field(
default="http://engine:8100",
validation_alias="ENGINE_URL",
)
engine_mode: EngineMode = Field(
default="claude_api",
validation_alias="ENGINE_MODE",
)
engine_timeout: float = 120.0 # SSE 롱리브드 (50분 상담 대비, 스트림은 무제한 별도)
engine_connect_timeout: float = 10.0
admin_usage_budget_usd: float = Field(
default=0.0,
validation_alias="ADMIN_USAGE_BUDGET_USD",
)
evaluator_fast_model: str = Field(
default="",
validation_alias="EVALUATOR_FAST_MODEL",
)
evaluator_deep_model: str = Field(
default="",
validation_alias="EVALUATOR_DEEP_MODEL",
)
# ── 외부 LLM 키 (게이트웨이가 못 받을 때 직접 폴백, PII 마스킹 후만) ──
anthropic_api_key: str = Field(default="", validation_alias="ANTHROPIC_API_KEY")
openai_api_key: str = Field(default="", validation_alias="OPENAI_API_KEY")
openai_base_url: str = Field(
default="https://api.openai.com/v1",
validation_alias="OPENAI_BASE_URL",
)
voice_poc_sample_tts_enabled: bool = Field(
default=False,
validation_alias="VIGNETTE_VOICE_POC_SAMPLE_TTS",
)
voice_poc_sample_tts_dir: str = Field(
default="",
validation_alias="VIGNETTE_VOICE_POC_SAMPLE_TTS_DIR",
)
# ── 세션/인증 (BFF OAuth 2.1, 토큰 서버 보관) ────────
session_secret: str = Field(
default="dev-insecure-change-me",
validation_alias="SESSION_SECRET",
)
# __Host- 쿠키 정책: prod 에선 secure=True 강제
cookie_name: str = "__Host-vignette_sid"
session_ttl_seconds: int = 60 * 60 * 8 # 8h
# Google OIDC (1차, 한신대 SSO 는 2차 — R11)
oauth_google_client_id: str = Field(default="", validation_alias="OAUTH_GOOGLE_CLIENT_ID")
oauth_google_client_secret: str = Field(
default="", validation_alias="OAUTH_GOOGLE_CLIENT_SECRET"
)
oauth_redirect_uri: str = Field(
default="https://api-vignette.chanpaca.net/auth/callback",
validation_alias="OAUTH_REDIRECT_URI",
)
auth_allowed_email_domains: list[str] = Field(
default=["hs.ac.kr", "twentyoz.kr"],
validation_alias="AUTH_ALLOWED_EMAIL_DOMAINS",
)
auth_teacher_emails: list[str] = Field(
default=[],
validation_alias="AUTH_TEACHER_EMAILS",
)
auth_admin_emails: list[str] = Field(
default=[],
validation_alias="AUTH_ADMIN_EMAILS",
)
auth_email_cohort_map: dict[str, str] = Field(
default_factory=dict,
validation_alias="AUTH_EMAIL_COHORT_MAP",
)
auth_domain_cohort_map: dict[str, str] = Field(
default_factory=dict,
validation_alias="AUTH_DOMAIN_COHORT_MAP",
)
auth_dev_login_enabled: bool = Field(
default=False,
validation_alias="AUTH_DEV_LOGIN_ENABLED",
)
auth_saml_enabled: bool = Field(
default=False,
validation_alias="AUTH_SAML_ENABLED",
)
saml_sp_entity_id: str = Field(
default="",
validation_alias="SAML_SP_ENTITY_ID",
)
saml_sso_url: str = Field(
default="",
validation_alias="SAML_SSO_URL",
)
saml_x509_cert_fingerprint: str = Field(
default="",
validation_alias="SAML_X509_CERT_FINGERPRINT",
)
default_affiliation: str = Field(
default="",
validation_alias="DEFAULT_AFFILIATION",
)
frontend_base_url: str = Field(
default="http://localhost:5173",
validation_alias="FRONTEND_BASE_URL",
)
frontend_origin_map: dict[str, str] = Field(
default_factory=lambda: {
"api-vignette.chanpaca.net": "https://vignette.chanpaca.net",
"api-vnet.18ka.net": "https://vnet.18ka.net",
},
validation_alias="FRONTEND_ORIGIN_MAP",
)
# ── CORS (정적 프론트 + SSE 분리경로) ────────────────
cors_origins: list[str] = Field(
default=[
"https://vignette.chanpaca.net",
"https://vnet.18ka.net",
"https://vignette-b1q.pages.dev",
],
validation_alias="CORS_ORIGINS",
)
auth_dev_login_extra_origins: list[str] = Field(
default=[],
validation_alias="AUTH_DEV_LOGIN_EXTRA_ORIGINS",
)
# Built-in personas are developer/bootstrap fixtures, not runtime truth.
# Production should use approved rows from app.persona_card only.
auto_seed_personas: bool = Field(
default=False,
validation_alias="AUTO_SEED_PERSONAS",
)
allow_seed_persona_fallback: bool = Field(
default=False,
validation_alias="ALLOW_SEED_PERSONA_FALLBACK",
)
# ── SSE 스트리밍 ─────────────────────────────────────
sse_heartbeat_seconds: int = 30 # Cloudflare 100초 timeout 회피 (R2)
@property
def is_prod(self) -> bool:
return self.environment == "prod"
@model_validator(mode="after")
def validate_non_dev_runtime_flags(self) -> "Settings":
if self.environment != "dev":
forbidden: list[str] = []
if self.auth_dev_login_enabled:
forbidden.append("AUTH_DEV_LOGIN_ENABLED")
if self.auto_seed_personas:
forbidden.append("AUTO_SEED_PERSONAS")
if self.allow_seed_persona_fallback:
forbidden.append("ALLOW_SEED_PERSONA_FALLBACK")
if self.voice_poc_sample_tts_enabled:
forbidden.append("VIGNETTE_VOICE_POC_SAMPLE_TTS")
if not self.oauth_google_client_id.strip():
forbidden.append("OAUTH_GOOGLE_CLIENT_ID")
if not self.oauth_google_client_secret.strip():
forbidden.append("OAUTH_GOOGLE_CLIENT_SECRET")
if self.session_secret == "dev-insecure-change-me":
forbidden.append("SESSION_SECRET")
if _is_local_url(self.frontend_base_url):
forbidden.append("FRONTEND_BASE_URL")
if any(_is_local_or_forbidden_non_dev_origin(origin) for origin in self.cors_origins):
forbidden.append("CORS_ORIGINS")
if any(
_is_local_or_forbidden_non_dev_origin(origin)
for origin in self.frontend_origin_map.values()
):
forbidden.append("FRONTEND_ORIGIN_MAP")
if forbidden:
joined = ", ".join(forbidden)
raise ValueError(f"{joined} must be production-safe when ENVIRONMENT={self.environment}")
if self.auth_saml_enabled:
missing_saml: list[str] = []
if not self.saml_sp_entity_id.strip():
missing_saml.append("SAML_SP_ENTITY_ID")
if not self.saml_sso_url.strip():
missing_saml.append("SAML_SSO_URL")
if missing_saml:
joined = ", ".join(missing_saml)
raise ValueError(f"{joined} must be configured when AUTH_SAML_ENABLED=true")
return self
@lru_cache
def get_settings() -> Settings:
"""프로세스 1회 로드 (lru_cache). 의존성 주입은 deps.get_settings_dep 사용."""
return Settings()
settings = get_settings()
Reference in a new issue View git blame Copy permalink