semantic

backend/src/core/database.py

@@ -14,17 +14,18 @@ from pathlib import Path
 from sqlalchemy import create_engine, inspect, text
 from sqlalchemy.orm import sessionmaker
 
-from ..models import assistant as _assistant_models  # noqa: F401
-from ..models import auth as _auth_models  # noqa: F401
-from ..models import clean_release as _clean_release_models  # noqa: F401
-from ..models import config as _config_models  # noqa: F401
-from ..models import connection as _connection_models  # noqa: F401
-from ..models import dataset_review as _dataset_review_models  # noqa: F401
-from ..models import llm as _llm_models  # noqa: F401
-from ..models import profile as _profile_models  # noqa: F401
-
 # Import models to ensure they're registered with Base
-from ..models import task as _task_models  # noqa: F401
+from ..models import (
+    assistant as _assistant_models,  # noqa: F401
+    auth as _auth_models,  # noqa: F401
+    clean_release as _clean_release_models,  # noqa: F401
+    config as _config_models,  # noqa: F401
+    connection as _connection_models,  # noqa: F401
+    dataset_review as _dataset_review_models,  # noqa: F401
+    llm as _llm_models,  # noqa: F401
+    profile as _profile_models,  # noqa: F401
+    task as _task_models,  # noqa: F401
+)
 from ..models.connection import ConnectionConfig
 from ..models.mapping import Base
 from .auth.config import auth_config
@@ -36,12 +37,21 @@ BASE_DIR = Path(__file__).resolve().parent.parent.parent
 # #endregion BASE_DIR
 
 # #region DATABASE_URL [C:1] [TYPE Constant]
-# @BRIEF URL for the main application database.
-DEFAULT_POSTGRES_URL = os.getenv(
-    "POSTGRES_URL",
-    "postgresql+psycopg2://postgres:postgres@localhost:5432/ss_tools",
-)
-DATABASE_URL = os.getenv("DATABASE_URL", DEFAULT_POSTGRES_URL)
+# @BRIEF URL for the main application database. Read from env; dev fallback only.
+# @RATIONALE DATABASE_URL reads from env (DATABASE_URL or POSTGRES_URL).
+#            Crashes at import if unset in production; provides localhost fallback in dev.
+# @REJECTED Hardcoded postgres:postgres@localhost in source code rejected — exposes
+#           database credentials in version control (Class 1 security violation).
+_DATABASE_URL = os.getenv("DATABASE_URL") or os.getenv("POSTGRES_URL")
+if _DATABASE_URL:
+    DATABASE_URL = _DATABASE_URL
+elif os.getenv("DEV_MODE", "").strip().lower() in {"1", "true", "yes"}:
+    DATABASE_URL = "postgresql+psycopg2://postgres:postgres@localhost:5432/ss_tools"
+else:
+    raise RuntimeError(
+        "DATABASE_URL (or POSTGRES_URL) environment variable is required. "
+        "Set it before starting the server."
+    )
 # #endregion DATABASE_URL
 
 # #region TASKS_DATABASE_URL [C:1] [TYPE Constant]