commit all

2026-02-28 23:57:35 +01:00
parent 55e65a64ba
commit d8237ae76d
1 changed files with 189 additions and 0 deletions
@@ -0,0 +1,189 @@
+from __future__ import annotations
+
+import base64
+import functools
+import json
+from decimal import Decimal
+from typing import Annotated, Self
+
+from pydantic import Field, field_validator, model_validator
+from pydantic_settings import BaseSettings, NoDecode, SettingsConfigDict
+
+
+class Settings(BaseSettings):
+    """Application settings loaded from environment variables."""
+
+    # LLM
+    ANTHROPIC_AUTH_TOKEN: str = Field(..., description="Anthropic auth token")
+    ANTHROPIC_BASE_URL: str = Field(
+        default="https://api.anthropic.com",
+        description="Anthropic API base URL",
+    )
+    ANTHROPIC_MODEL: str = Field(
+        default="claude-sonnet-4-6",
+        description="Anthropic model identifier",
+    )
+    ANTHROPIC_TIMEOUT_CONNECT: float = Field(default=10.0, description="Anthropic connect timeout")
+    ANTHROPIC_TIMEOUT_READ: float = Field(default=60.0, description="Anthropic read timeout")
+    LOCAL_MODEL_ENDPOINT: str = Field(
+        default="http://localhost:11434/v1",
+        description="Local model API endpoint",
+    )
+
+    # Database
+    DATABASE_URL: str = Field(..., description="Async PostgreSQL connection URL")
+    DB_POOL_SIZE: int = Field(default=10, description="Database pool size")
+    DB_MAX_OVERFLOW: int = Field(default=20, description="Database max overflow")
+    DB_POOL_TIMEOUT: float = Field(default=30.0, description="Database pool timeout seconds")
+    DB_POOL_RECYCLE: int = Field(default=3600, description="Database pool recycle seconds")
+
+    # Redis
+    REDIS_URL: str = Field(default="redis://localhost:6379/0", description="Redis URL")
+    REDIS_RATE_LIMIT_PER_MINUTE: int = Field(default=60, description="Rate limit per minute")
+
+    # Milvus
+    MILVUS_HOST: str = Field(default="localhost", description="Milvus host")
+    MILVUS_PORT: int = Field(default=19530, description="Milvus port")
+    MILVUS_COLLECTION_PREFIX: str = Field(
+        default="agent_platform",
+        description="Milvus collection prefix",
+    )
+
+    # Auth
+    JWT_SECRET_KEY: str = Field(..., min_length=32, description="JWT secret key")
+    JWT_ALGORITHM: str = Field(default="HS256", description="JWT algorithm")
+    JWT_EXPIRE_MINUTES: int = Field(default=480, description="JWT expiry in minutes")
+
+    # Observability
+    OTEL_SERVICE_NAME: str = Field(default="agent-platform", description="OTel service name")
+    OTEL_EXPORTER_OTLP_ENDPOINT: str = Field(
+        default="http://localhost:4317",
+        description="OTLP endpoint",
+    )
+    LOG_LEVEL: str = Field(default="INFO", description="Application log level")
+
+    # App
+    ENVIRONMENT: str = Field(default="development", description="Runtime environment")
+    ALLOWED_ORIGINS: Annotated[list[str], NoDecode] = Field(
+        default_factory=list,
+        description="Allowed CORS origins",
+    )
+
+    # Cost Budgets (Decimal)
+    MAX_DAILY_COST_CNY: Decimal = Field(
+        default=Decimal("500.00"),
+        description="Daily budget in CNY",
+    )
+    MAX_MONTHLY_COST_CNY: Decimal = Field(
+        default=Decimal("2000.00"),
+        description="Monthly budget in CNY",
+    )
+    COST_ALERT_THRESHOLD_PCT: Decimal = Field(
+        default=Decimal("0.80"),
+        description="Cost alert threshold ratio",
+    )
+
+    # Audit Encryption
+    AUDIT_KEYRING_JSON: str = Field(..., description="JSON map of key_id -> base64(aes-256 key)")
+    AUDIT_ACTIVE_KEY_ID: str = Field(default="k1", description="Active audit key ID")
+
+    model_config = SettingsConfigDict(
+        env_file=".env",
+        env_file_encoding="utf-8",
+        case_sensitive=False,
+        extra="ignore",
+    )
+
+    @field_validator("DATABASE_URL")
+    @classmethod
+    def validate_database_url(cls, value: str) -> str:
+        if not value.startswith("postgresql+asyncpg://"):
+            raise ValueError("DATABASE_URL must start with postgresql+asyncpg://")
+        return value
+
+    @field_validator("ENVIRONMENT")
+    @classmethod
+    def validate_environment(cls, value: str) -> str:
+        allowed = {"development", "production", "test"}
+        if value not in allowed:
+            raise ValueError("ENVIRONMENT must be one of development/production/test")
+        return value
+
+    @field_validator("ALLOWED_ORIGINS", mode="before")
+    @classmethod
+    def parse_allowed_origins(cls, value: object) -> list[str]:
+        if value is None:
+            return []
+        if isinstance(value, list):
+            if not all(isinstance(item, str) for item in value):
+                raise ValueError("ALLOWED_ORIGINS list items must be strings")
+            return value
+        if isinstance(value, str):
+            stripped = value.strip()
+            if not stripped:
+                return []
+            if stripped.startswith("["):
+                try:
+                    parsed = json.loads(stripped)
+                except json.JSONDecodeError as exc:
+                    raise ValueError(
+                        "ALLOWED_ORIGINS JSON must be a valid list of strings"
+                    ) from exc
+                if not isinstance(parsed, list) or not all(
+                    isinstance(item, str) for item in parsed
+                ):
+                    raise ValueError("ALLOWED_ORIGINS JSON must be a list of strings")
+                return parsed
+            return [item.strip() for item in stripped.split(",") if item.strip()]
+        raise ValueError("ALLOWED_ORIGINS must be a list or string")
+
+    @model_validator(mode="after")
+    def validate_audit_keyring(self) -> Self:
+        parsed: object
+        try:
+            parsed = json.loads(self.AUDIT_KEYRING_JSON)
+        except json.JSONDecodeError as exc:
+            raise ValueError("AUDIT_KEYRING_JSON must be valid JSON") from exc
+
+        if not isinstance(parsed, dict):
+            raise ValueError("AUDIT_KEYRING_JSON must be a JSON object")
+
+        keyring: dict[str, str] = {}
+        for key_id_obj, key_b64_obj in parsed.items():
+            if not isinstance(key_id_obj, str) or not isinstance(key_b64_obj, str):
+                raise ValueError(
+                    "AUDIT_KEYRING_JSON must be a map of string key_id to string base64"
+                )
+            keyring[key_id_obj] = key_b64_obj
+
+        if self.AUDIT_ACTIVE_KEY_ID not in keyring:
+            raise ValueError("AUDIT_ACTIVE_KEY_ID must exist in AUDIT_KEYRING_JSON")
+
+        for key_id, key_b64 in keyring.items():
+            try:
+                key_bytes = base64.b64decode(key_b64, validate=True)
+            except Exception as exc:  # noqa: BLE001
+                raise ValueError(f"Audit key '{key_id}' is not valid base64") from exc
+            if len(key_bytes) != 32:
+                raise ValueError(f"Audit key '{key_id}' must decode to exactly 32 bytes")
+
+        return self
+
+
+@functools.lru_cache(maxsize=1)
+def get_settings() -> Settings:
+    """Lazily load and cache application settings."""
+
+    return Settings()  # type: ignore[call-arg]
+
+
+def is_production() -> bool:
+    return get_settings().ENVIRONMENT == "production"
+
+
+def is_development() -> bool:
+    return get_settings().ENVIRONMENT == "development"
+
+
+def is_test() -> bool:
+    return get_settings().ENVIRONMENT == "test"