Michael
bab2c9468c
Source-agnostic license issuance service. FastAPI app fronts a Postgres `licenses` table; the only currently-wired source is `manual` (operator mints via /internal/mint). Gumroad webhook adapter lands in PR 2. Key design points: - Signing reuses src/license/crypto.py via a COPY into the image (single source of truth — blobs minted server-side verify against the same embedded pubkey on the buyer's machine). - Source adapter Protocol (app/adapters/base.py) is the seam for Gumroad / Lemon Squeezy / Stripe in later PRs; Mint API speaks only SaleEvent / RefundEvent. - (source, source_order_id) UNIQUE composite gives idempotent webhook retries without double-mint. - JSONB type uses with_variant(JSON, 'sqlite') so the same models drive both Postgres prod and SQLite tests (no testcontainers dep). - Bearer-token auth on /internal/*; the IP-loopback guard was removed after the docker bridge made it fight legitimate prod traffic (nginx defense + Bearer remain). - Secrets resolved via *_FILE env vars pointing at /run/secrets/<name>, so passwords never appear in `docker inspect`. 21 unit tests (SQLite in-memory, StaticPool) plus a real-Postgres docker-compose smoke test in server/scripts/smoke.sh that builds the image, runs the alembic migration, mints a license, verifies the signature against the host dev pubkey, and checks the DB row. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
65 lines
2.5 KiB
Python
65 lines
2.5 KiB
Python
"""Runtime configuration loaded from environment + secret files.
|
|
|
|
Secrets are read from files (``*_FILE`` env vars pointing at
|
|
``/run/secrets/<name>``) so they never appear in ``docker inspect``
|
|
or process environment dumps. Plain ``*`` vars are the fallback for
|
|
local development where mounting secret files is overkill.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from functools import lru_cache
|
|
from pathlib import Path
|
|
from typing import Optional
|
|
|
|
from pydantic import Field
|
|
from pydantic_settings import BaseSettings, SettingsConfigDict
|
|
|
|
|
|
class Settings(BaseSettings):
|
|
model_config = SettingsConfigDict(env_file=".env", extra="ignore")
|
|
|
|
database_url: str = Field(
|
|
default="postgresql+psycopg://datatools_api@localhost:5432/datatools_licenses",
|
|
validation_alias="DATABASE_URL",
|
|
)
|
|
|
|
admin_token: Optional[str] = Field(default=None, validation_alias="DATATOOLS_ADMIN_TOKEN")
|
|
admin_token_file: Optional[Path] = Field(default=None, validation_alias="DATATOOLS_ADMIN_TOKEN_FILE")
|
|
|
|
license_privkey_hex: Optional[str] = Field(default=None, validation_alias="DATATOOLS_LICENSE_PRIVKEY")
|
|
license_privkey_file: Optional[Path] = Field(default=None, validation_alias="DATATOOLS_LICENSE_PRIVKEY_FILE")
|
|
|
|
license_pubkey_hex: Optional[str] = Field(default=None, validation_alias="DATATOOLS_LICENSE_PUBKEY")
|
|
|
|
postmark_token: Optional[str] = Field(default=None, validation_alias="POSTMARK_TOKEN")
|
|
postmark_token_file: Optional[Path] = Field(default=None, validation_alias="POSTMARK_TOKEN_FILE")
|
|
|
|
gumroad_secret: Optional[str] = Field(default=None, validation_alias="GUMROAD_WEBHOOK_SECRET")
|
|
gumroad_secret_file: Optional[Path] = Field(default=None, validation_alias="GUMROAD_WEBHOOK_SECRET_FILE")
|
|
|
|
def resolve_admin_token(self) -> Optional[str]:
|
|
return _resolve(self.admin_token, self.admin_token_file)
|
|
|
|
def resolve_license_privkey(self) -> Optional[str]:
|
|
return _resolve(self.license_privkey_hex, self.license_privkey_file)
|
|
|
|
def resolve_postmark_token(self) -> Optional[str]:
|
|
return _resolve(self.postmark_token, self.postmark_token_file)
|
|
|
|
def resolve_gumroad_secret(self) -> Optional[str]:
|
|
return _resolve(self.gumroad_secret, self.gumroad_secret_file)
|
|
|
|
|
|
def _resolve(inline: Optional[str], path: Optional[Path]) -> Optional[str]:
|
|
if inline:
|
|
return inline.strip()
|
|
if path and path.exists():
|
|
return path.read_text(encoding="utf-8").strip()
|
|
return None
|
|
|
|
|
|
@lru_cache(maxsize=1)
|
|
def get_settings() -> Settings:
|
|
return Settings()
|