Michael Chihlas
92fa3bc6ab
First commit in the session-expiration-policy series (see docs/plans/2026-05-13-session-expiration-policy.md). No behavior change yet — this lays the schema + settings groundwork only. - Settings: SESSION_IDLE_MINUTES_DEFAULT=4320 (3d), SESSION_ABSOLUTE_MINUTES_DEFAULT=20160 (14d), plus MIN/MAX bounds so account overrides have envelopes (15min..30d idle, 1h..90d absolute). - accounts table: nullable session_idle_minutes and session_absolute_minutes columns (NULL = use system default), plus a CHECK constraint that rejects idle > absolute when both are set. Partial-override validation lives at the app layer because the DB cannot read Settings. Subsequent commits will: distinguish idle vs invalid-token expiry on the wire, embed auth_time/idle_max/abs_max in refresh JWTs, enforce the absolute cap in /auth/refresh, add the owner-only policy + bulk-revoke endpoints, and surface everything in an AccountSecurity settings page with a session-expiry toast. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
288 lines
12 KiB
Python
288 lines
12 KiB
Python
from pydantic_settings import BaseSettings
|
||
from pydantic import field_validator
|
||
from typing import Optional
|
||
|
||
|
||
_DEFAULT_SECRET_KEY = "your-secret-key-change-in-production-use-openssl-rand-hex-32"
|
||
|
||
|
||
class Settings(BaseSettings):
|
||
# Application
|
||
APP_NAME: str = "ResolutionFlow"
|
||
DEBUG: bool = False
|
||
API_V1_PREFIX: str = "/api/v1"
|
||
|
||
# Database - Railway provides DATABASE_URL, we convert it for asyncpg
|
||
DATABASE_URL: str = "postgresql+asyncpg://postgres:postgres@localhost:5432/patherly"
|
||
|
||
@field_validator("DATABASE_URL", mode="before")
|
||
@classmethod
|
||
def convert_database_url(cls, v: str) -> str:
|
||
"""Convert standard postgres URL to asyncpg format."""
|
||
if v.startswith("postgresql://"):
|
||
return v.replace("postgresql://", "postgresql+asyncpg://", 1)
|
||
return v
|
||
|
||
# Sync URL for Alembic migrations. Defaults to DATABASE_URL (sync-converted).
|
||
# Set explicitly in .env to use a different role for migrations (e.g. superuser)
|
||
# when DATABASE_URL has been switched to the app role.
|
||
DATABASE_URL_SYNC: str = ""
|
||
|
||
@field_validator("DATABASE_URL_SYNC", mode="before")
|
||
@classmethod
|
||
def default_database_url_sync(cls, v: str, info) -> str:
|
||
"""Fall back to sync-converted DATABASE_URL if not explicitly set."""
|
||
if not v:
|
||
base = info.data.get("DATABASE_URL", "")
|
||
return base.replace("postgresql+asyncpg://", "postgresql://", 1)
|
||
return v
|
||
|
||
# Admin database — resolutionflow_admin role, BYPASSRLS.
|
||
# Used by /admin/* endpoints. Defaults to DATABASE_URL for local dev.
|
||
ADMIN_DATABASE_URL: str = ""
|
||
|
||
@field_validator("ADMIN_DATABASE_URL", mode="before")
|
||
@classmethod
|
||
def default_admin_database_url(cls, v: str, info) -> str:
|
||
"""Fall back to DATABASE_URL if ADMIN_DATABASE_URL is not set."""
|
||
if not v:
|
||
return info.data.get("DATABASE_URL", "")
|
||
if v.startswith("postgresql://"):
|
||
return v.replace("postgresql://", "postgresql+asyncpg://", 1)
|
||
return v
|
||
|
||
# JWT Settings
|
||
SECRET_KEY: str = _DEFAULT_SECRET_KEY
|
||
|
||
@field_validator("SECRET_KEY", mode="after")
|
||
@classmethod
|
||
def reject_default_secret_in_production(cls, v: str, info) -> str:
|
||
"""Fail loudly if the default secret key is used outside of DEBUG mode."""
|
||
debug = info.data.get("DEBUG", False)
|
||
if v == _DEFAULT_SECRET_KEY and not debug:
|
||
raise ValueError(
|
||
"SECRET_KEY must be set to a secure value in production. "
|
||
"Generate one with: openssl rand -hex 32"
|
||
)
|
||
return v
|
||
ALGORITHM: str = "HS256"
|
||
ACCESS_TOKEN_EXPIRE_MINUTES: int = 5
|
||
REFRESH_TOKEN_EXPIRE_DAYS: int = 7
|
||
|
||
# Session policy — see docs/plans/2026-05-13-session-expiration-policy.md
|
||
# Refresh tokens enforce two windows: idle (between rotations) and absolute
|
||
# (from original login). Defaults can be overridden per-account, bounded by
|
||
# the MIN/MAX values below. Values are minutes everywhere except inside the
|
||
# refresh JWT, where idle_max/abs_max are stored as seconds for direct
|
||
# Unix-time math.
|
||
SESSION_IDLE_MINUTES_DEFAULT: int = 4320 # 3 days
|
||
SESSION_ABSOLUTE_MINUTES_DEFAULT: int = 20160 # 14 days
|
||
SESSION_IDLE_MINUTES_MIN: int = 15
|
||
SESSION_IDLE_MINUTES_MAX: int = 43200 # 30 days
|
||
SESSION_ABSOLUTE_MINUTES_MIN: int = 60 # 1 hour
|
||
SESSION_ABSOLUTE_MINUTES_MAX: int = 129600 # 90 days
|
||
|
||
# Security
|
||
BCRYPT_ROUNDS: int = 12
|
||
|
||
# Security Headers
|
||
CSP_REPORT_ONLY: bool = True # Set False to enforce CSP
|
||
CSP_EXTRA_SCRIPT_SOURCES: list[str] = [] # Additional script-src domains
|
||
CSP_EXTRA_CONNECT_SOURCES: list[str] = [] # Additional connect-src domains
|
||
|
||
# Registration
|
||
REQUIRE_INVITE_CODE: bool = True # Set to False to allow open registration
|
||
|
||
# Email (Resend)
|
||
RESEND_API_KEY: Optional[str] = None
|
||
FROM_EMAIL: str = "ResolutionFlow <invites@resolutionflow.com>"
|
||
FEEDBACK_EMAIL: Optional[str] = None
|
||
SALES_LEAD_RECIPIENT_EMAIL: str = "sales@resolutionflow.com"
|
||
|
||
@property
|
||
def email_enabled(self) -> bool:
|
||
"""Check if email sending is configured."""
|
||
return self.RESEND_API_KEY is not None
|
||
|
||
# Stripe
|
||
STRIPE_SECRET_KEY: Optional[str] = None
|
||
STRIPE_PUBLISHABLE_KEY: Optional[str] = None
|
||
STRIPE_WEBHOOK_SECRET: Optional[str] = None
|
||
SELF_SERVE_ENABLED: bool = False
|
||
|
||
# Internal tester allowlist for soft cutover. Comma-separated emails;
|
||
# when SELF_SERVE_ENABLED is False, listed users still see the self-serve
|
||
# surfaces (pricing page, invite-code-optional registration, etc.) so the
|
||
# full flow can be exercised in prod test mode before public flip.
|
||
INTERNAL_TESTER_EMAILS: list[str] = []
|
||
|
||
@field_validator("INTERNAL_TESTER_EMAILS", mode="before")
|
||
@classmethod
|
||
def split_internal_tester_emails(cls, v) -> list[str]:
|
||
"""Parse a comma-separated string into a normalized lowercase list."""
|
||
if v is None or v == "":
|
||
return []
|
||
if isinstance(v, list):
|
||
return [e.strip().lower() for e in v if e and e.strip()]
|
||
if isinstance(v, str):
|
||
return [e.strip().lower() for e in v.split(",") if e.strip()]
|
||
return []
|
||
|
||
def is_internal_tester(self, email: Optional[str]) -> bool:
|
||
"""Case-insensitive allowlist check. None/empty email is never a tester."""
|
||
if not email:
|
||
return False
|
||
return email.lower() in self.INTERNAL_TESTER_EMAILS
|
||
|
||
def is_self_serve_active_for(self, email: Optional[str]) -> bool:
|
||
"""True if self-serve surfaces should render for this user.
|
||
|
||
Either the global flag is on, or the user is on the internal-tester
|
||
allowlist. Anonymous calls (email is None) only see the global flag.
|
||
"""
|
||
if self.SELF_SERVE_ENABLED:
|
||
return True
|
||
return self.is_internal_tester(email)
|
||
|
||
@property
|
||
def stripe_enabled(self) -> bool:
|
||
"""Check if Stripe is configured."""
|
||
return bool(self.STRIPE_SECRET_KEY)
|
||
|
||
# AI Flow Builder
|
||
ANTHROPIC_API_KEY: Optional[str] = None
|
||
AI_MODEL: str = "claude-sonnet-4-6"
|
||
AI_CONVERSATION_TTL_HOURS: int = 24
|
||
AI_MAX_CALLS_PER_FLOW: int = 10
|
||
AI_REQUEST_TIMEOUT_SECONDS: int = 120
|
||
# AI Provider selection
|
||
AI_PROVIDER: str = "anthropic" # "gemini" or "anthropic"
|
||
GOOGLE_AI_API_KEY: Optional[str] = None
|
||
AI_MODEL_GEMINI: str = "gemini-2.5-flash"
|
||
AI_MODEL_ANTHROPIC: str = "claude-sonnet-4-6"
|
||
# Bound for the diagnostic assessment Sonnet call. Generation runs in a
|
||
# FastAPI BackgroundTask (commit e8ba74e), so this no longer blocks the
|
||
# senior's click — only how long we wait before publishing
|
||
# `handoff_assessment_ready` with has_assessment=false. 15s was hitting
|
||
# tail latency on Sonnet (timeout 03:57:35 in field testing 2026-04-29),
|
||
# leaving the magic-moment placeholder permanent. 45s is the right
|
||
# ceiling: well above Sonnet p99 for a 500-token output, far enough
|
||
# below "the senior gives up watching" that we still surface SOMETHING
|
||
# on persistent slowness.
|
||
ESCALATION_AI_ASSESSMENT_TIMEOUT_SECONDS: int = 45
|
||
|
||
# Model tier routing — maps action types to model tiers
|
||
AI_MODEL_TIERS: dict[str, str] = {
|
||
"fast": "claude-haiku-4-5-20251001",
|
||
"standard": "claude-sonnet-4-6",
|
||
}
|
||
|
||
ACTION_MODEL_MAP: dict[str, str] = {
|
||
"generate_full": "standard",
|
||
"generate_branch": "standard",
|
||
"modify_node": "fast",
|
||
"add_steps": "standard",
|
||
"quick_action": "fast",
|
||
"open_chat": "standard",
|
||
"variable_inference": "fast",
|
||
"kb_convert": "standard",
|
||
"script_build": "standard",
|
||
"network_diagram_generate": "standard",
|
||
# FlowPilot migration Phase 2 — short, latency-sensitive transformation
|
||
# of an engineer's answer/check output into a candidate fact.
|
||
# Doc Section 6.6 sets Haiku as the default; instrumentation tracks
|
||
# disputed_fact_rate so we can escalate to Sonnet if quality drops.
|
||
"fact_synthesis": "fast",
|
||
# FlowPilot migration Phase 3 — resolution-note preview that ships to
|
||
# the customer ticket. Sonnet because customer-facing artifact quality
|
||
# matters more than latency; the in-process state_version cache keeps
|
||
# cost manageable.
|
||
"resolution_note": "standard",
|
||
# FlowPilot migration Phase 4 — escalation handoff package. Parallel
|
||
# to resolution_note: Sonnet, same cache story, no MCP.
|
||
"escalation_package": "standard",
|
||
# FlowPilot migration Phase 5 — extract a parameter schema from a
|
||
# concrete rendered script so a draft_template can be proposed.
|
||
# Creates a persistent library artifact on accept, so Sonnet.
|
||
"template_extraction": "standard",
|
||
}
|
||
|
||
def get_model_for_action(self, action_type: str) -> str:
|
||
"""Resolve an action type to a concrete model name via tier routing."""
|
||
tier = self.ACTION_MODEL_MAP.get(action_type, "standard")
|
||
return self.AI_MODEL_TIERS.get(tier, self.AI_MODEL_TIERS["standard"])
|
||
|
||
# MCP (Model Context Protocol) integrations
|
||
ENABLE_MCP_MICROSOFT_LEARN: bool = True
|
||
|
||
# Embedding / RAG
|
||
VOYAGE_API_KEY: Optional[str] = None
|
||
EMBEDDING_MODEL: str = "voyage-3.5"
|
||
EMBEDDING_DIMENSIONS: int = 1024
|
||
|
||
@property
|
||
def ai_enabled(self) -> bool:
|
||
"""Check if any AI provider is configured."""
|
||
return self.ANTHROPIC_API_KEY is not None or self.GOOGLE_AI_API_KEY is not None
|
||
|
||
# Object Storage (Railway S3-compatible)
|
||
STORAGE_ENDPOINT: str | None = None
|
||
STORAGE_ACCESS_KEY: str | None = None
|
||
STORAGE_SECRET_KEY: str | None = None
|
||
STORAGE_BUCKET_NAME: str = "resolutionflow-uploads"
|
||
STORAGE_REGION: str = "us-east-1"
|
||
|
||
# ConnectWise PSA Integration
|
||
# CW_CLIENT_ID is a product-level GUID registered at developer.connectwise.com
|
||
# All MSP customers share this single clientId — it identifies ResolutionFlow as the integration
|
||
CW_CLIENT_ID: Optional[str] = None
|
||
|
||
@property
|
||
def cw_enabled(self) -> bool:
|
||
"""Check if ConnectWise integration is configured."""
|
||
return self.CW_CLIENT_ID is not None
|
||
|
||
# OAuth providers (self-serve signup)
|
||
GOOGLE_CLIENT_ID: Optional[str] = None
|
||
GOOGLE_CLIENT_SECRET: Optional[str] = None
|
||
MS_CLIENT_ID: Optional[str] = None
|
||
MS_CLIENT_SECRET: Optional[str] = None
|
||
OAUTH_REDIRECT_BASE: str = "http://localhost:5173"
|
||
|
||
# Monitoring
|
||
SENTRY_DSN: Optional[str] = None
|
||
|
||
# Deployment – auto-seed test data on PR environments
|
||
SEED_ON_DEPLOY: bool = False
|
||
|
||
# CORS - set FRONTEND_URL in production (e.g., https://patherly.up.railway.app)
|
||
CORS_ORIGINS: list[str] = ["http://localhost:3000", "http://localhost:5173", "http://localhost:5174"]
|
||
FRONTEND_URL: Optional[str] = None
|
||
# Allow all Railway PR environments (set to True in Railway env vars)
|
||
ALLOW_RAILWAY_ORIGINS: bool = False
|
||
|
||
@property
|
||
def allowed_origins(self) -> list[str]:
|
||
"""Get all allowed CORS origins including FRONTEND_URL if set."""
|
||
origins = self.CORS_ORIGINS.copy()
|
||
if self.FRONTEND_URL and self.FRONTEND_URL not in origins:
|
||
origins.append(self.FRONTEND_URL)
|
||
return origins
|
||
|
||
def is_origin_allowed(self, origin: str) -> bool:
|
||
"""Check if an origin is allowed, including Railway wildcard pattern."""
|
||
if origin in self.allowed_origins:
|
||
return True
|
||
# Allow any *.up.railway.app origin for PR environments
|
||
if self.ALLOW_RAILWAY_ORIGINS and origin.endswith(".up.railway.app"):
|
||
return True
|
||
return False
|
||
|
||
class Config:
|
||
env_file = ".env"
|
||
case_sensitive = True
|
||
extra = "ignore" # Ignore extra env vars like DATABASE_URL_SYNC
|
||
|
||
|
||
settings = Settings()
|