semantic

backend/src/core/auth/config.py

@@ -4,9 +4,16 @@
 # @LAYER:     Core
 # @RELATION DEPENDS_ON -> pydantic
 #
-# @INVARIANT: All sensitive configuration must have defaults or be loaded from environment.
+# @INVARIANT: All sensitive configuration must be loaded from environment; no hardcoded secrets.
+# @RATIONALE SECRET_KEY and AUTH_DATABASE_URL now crash-early if env vars are missing.
+#            Dev fallback for AUTH_DATABASE_URL only when DEV_MODE=true.
+# @REJECTED Default secrets in source code rejected — Class 1 security violation:
+#           "super-secret-key-change-in-production" and "postgres:postgres" exposed
+#           secrets in version control.
 
-from pydantic import Field
+import os
+
+from pydantic import Field, field_validator
 from pydantic_settings import BaseSettings
 
 
@@ -17,22 +24,42 @@ from pydantic_settings import BaseSettings
 # @RELATION INHERITS -> pydantic_settings.BaseSettings
 class AuthConfig(BaseSettings):
     # JWT Settings
-    SECRET_KEY: str = Field(default="super-secret-key-change-in-production", env="AUTH_SECRET_KEY")
+    SECRET_KEY: str = Field(default="", env="AUTH_SECRET_KEY")
     ALGORITHM: str = "HS256"
     ACCESS_TOKEN_EXPIRE_MINUTES: int = 480
     REFRESH_TOKEN_EXPIRE_DAYS: int = 7
 
     # Database Settings
-    AUTH_DATABASE_URL: str = Field(
-        default="postgresql+psycopg2://postgres:postgres@localhost:5432/ss_tools",
-        env="AUTH_DATABASE_URL",
-    )
+    AUTH_DATABASE_URL: str = Field(default="", env="AUTH_DATABASE_URL")
 
     # ADFS Settings
     ADFS_CLIENT_ID: str = Field(default="", env="ADFS_CLIENT_ID")
     ADFS_CLIENT_SECRET: str = Field(default="", env="ADFS_CLIENT_SECRET")
     ADFS_METADATA_URL: str = Field(default="", env="ADFS_METADATA_URL")
 
+    @field_validator("SECRET_KEY", mode="after")
+    @classmethod
+    def validate_secret_key(cls, v: str) -> str:
+        if v:
+            return v
+        raise ValueError(
+            "AUTH_SECRET_KEY environment variable is required. "
+            "Set it in .env or export it before starting the server."
+        )
+
+    @field_validator("AUTH_DATABASE_URL", mode="after")
+    @classmethod
+    def validate_auth_db_url(cls, v: str) -> str:
+        if v:
+            return v
+        is_dev = os.getenv("DEV_MODE", "").strip().lower() in {"1", "true", "yes"}
+        if is_dev:
+            return "postgresql+psycopg2://postgres:postgres@localhost:5432/ss_tools"
+        raise ValueError(
+            "AUTH_DATABASE_URL environment variable is required. "
+            "Set it in .env or export it before starting the server."
+        )
+
     class Config:
         env_file = ".env"
         extra = "ignore"