Settings¶

@pydantic.model_validator(mode='before')
@classmethod
def merge_env_with_config(
    cls, data: dict[str, typing.Any]
) -> dict[str, typing.Any]:
    """Merge environment variables with config file data.

    For each BaseSettings submodel, instantiate it with the config file
    data as kwargs. This allows BaseSettings to use environment variables
    as defaults for any fields not provided in the config file.

    Args:
        data: Raw config data from TOML file

    Returns:
        Config data with BaseSettings instances properly constructed

    """
    settings_fields: dict[str, type[pydantic_settings.BaseSettings]] = {
        'auth': Auth,
        'clickhouse': Clickhouse,
        'embeddings': Embeddings,
        'plugins': Plugins,
        'postgres': Postgres,
        'releases': Releases,
        'ssl': SSL,
        'valkey': Valkey,
    }
    for field, settings_cls in settings_fields.items():
        if field in data and data[field] is not None:
            # Skip if already an instance (e.g., from direct construction)
            if isinstance(data[field], settings_cls):
                continue
            data[field] = settings_cls(**data[field])
    return data

@pydantic.model_validator(mode='after')
def validate_secrets(self) -> Auth:
    """Enforce explicit secrets outside development; auto-generate in dev.

    When ``ENVIRONMENT`` is anything other than ``development`` (the
    default), both ``IMBI_AUTH_JWT_SECRET`` and
    ``IMBI_AUTH_ENCRYPTION_KEY`` must be configured explicitly: booting
    with auto-generated per-process values would silently invalidate
    every issued token (and make every encrypted value undecryptable)
    on the next restart, so it is refused. In development the historical
    auto-generation behavior is preserved.

    ``model_fields_set`` distinguishes an explicitly-supplied value
    (env var, config file, or kwarg) from a default, and is inspected
    before the dev-mode auto-generation below mutates it.
    """
    if os.getenv('ENVIRONMENT', 'development').lower() != 'development':
        missing = sorted(
            name
            for name in ('jwt_secret', 'encryption_key')
            if name not in self.model_fields_set
        )
        if missing:
            raise ValueError(
                'These IMBI_AUTH_ settings must be set explicitly when '
                'ENVIRONMENT is not "development": ' + ', '.join(missing)
            )

    if self.encryption_key is None:
        from cryptography import fernet

        self.encryption_key = fernet.Fernet.generate_key().decode('ascii')
        LOGGER.warning(
            'Encryption key auto-generated. Set IMBI_AUTH_ENCRYPTION_KEY '
            'in production for stable key across restarts.'
        )
    return self

@pydantic.model_validator(mode='after')
def validate_secrets(self) -> ConfigSecrets:
    """Enforce an explicit key outside development; auto-generate in dev.

    When ``ENVIRONMENT`` is anything other than ``development`` (the
    default), ``IMBI_CONFIG_ENCRYPTION_KEY`` must be configured
    explicitly: booting with an auto-generated per-process value would
    silently make every encrypted configuration value undecryptable on
    the next restart, so it is refused. In development the historical
    auto-generation behavior is preserved.

    ``model_fields_set`` distinguishes an explicitly-supplied value
    (env var, config file, or kwarg) from a default, and is inspected
    before the dev-mode auto-generation below mutates it.
    """
    if os.getenv('ENVIRONMENT', 'development').lower() != 'development':
        if 'encryption_key' not in self.model_fields_set:
            raise ValueError(
                'IMBI_CONFIG_ENCRYPTION_KEY must be set explicitly when '
                'ENVIRONMENT is not "development"'
            )

    if self.encryption_key is None:
        from cryptography import fernet

        self.encryption_key = fernet.Fernet.generate_key().decode('ascii')
        LOGGER.warning(
            'Config encryption key auto-generated. Set '
            'IMBI_CONFIG_ENCRYPTION_KEY in production for a stable key '
            'across restarts.'
        )
    return self

def configure(self) -> None:
    """Configure the default SSL context if cert_dir is set.

    Patches ssl.create_default_context and
    ssl._create_default_https_context to load CA certificates from
    cert_dir on every call.
    """
    if self.cert_dir is None:
        return
    import ssl

    cert_dir = str(self.cert_dir)
    _orig = ssl.create_default_context

    def _patched(*args: object, **kwargs: object) -> ssl.SSLContext:
        ctx = _orig(*args, **kwargs)  # type: ignore[arg-type]
        ctx.load_verify_locations(capath=cert_dir)
        return ctx

    ssl.create_default_context = _patched
    ssl._create_default_https_context = _patched