Settings¶

@pydantic.model_validator(mode='after')
def validate_secrets(self) -> Auth:
    """Enforce explicit secrets outside development; auto-generate in dev.

    When ``ENVIRONMENT`` is anything other than ``development`` (the
    default), both ``IMBI_AUTH_JWT_SECRET`` and
    ``IMBI_AUTH_ENCRYPTION_KEY`` must be configured explicitly: booting
    with auto-generated per-process values would silently invalidate
    every issued token (and make every encrypted value undecryptable)
    on the next restart, so it is refused. In development the historical
    auto-generation behavior is preserved.

    ``model_fields_set`` distinguishes an explicitly-supplied value
    (env var, config file, or kwarg) from a default, and is inspected
    before the dev-mode auto-generation below mutates it.
    """
    if os.getenv('ENVIRONMENT', 'development').lower() != 'development':
        missing = sorted(
            name
            for name in ('jwt_secret', 'encryption_key')
            if name not in self.model_fields_set
        )
        if missing:
            raise ValueError(
                'These IMBI_AUTH_ settings must be set explicitly when '
                'ENVIRONMENT is not "development": ' + ', '.join(missing)
            )

    if self.encryption_key is None:
        from cryptography import fernet

        self.encryption_key = fernet.Fernet.generate_key().decode('ascii')
        LOGGER.warning(
            'Encryption key auto-generated. Set IMBI_AUTH_ENCRYPTION_KEY '
            'in production for stable key across restarts.'
        )
    return self

@pydantic.model_validator(mode='after')
def validate_secrets(self) -> ConfigSecrets:
    """Enforce an explicit key outside development; auto-generate in dev.

    When ``ENVIRONMENT`` is anything other than ``development`` (the
    default), ``IMBI_CONFIG_ENCRYPTION_KEY`` must be configured
    explicitly: booting with an auto-generated per-process value would
    silently make every encrypted configuration value undecryptable on
    the next restart, so it is refused. In development the historical
    auto-generation behavior is preserved.

    ``model_fields_set`` distinguishes an explicitly-supplied value
    (env var, config file, or kwarg) from a default, and is inspected
    before the dev-mode auto-generation below mutates it.
    """
    if os.getenv('ENVIRONMENT', 'development').lower() != 'development':
        if 'encryption_key' not in self.model_fields_set:
            raise ValueError(
                'IMBI_CONFIG_ENCRYPTION_KEY must be set explicitly when '
                'ENVIRONMENT is not "development"'
            )

    if self.encryption_key is None:
        from cryptography import fernet

        self.encryption_key = fernet.Fernet.generate_key().decode('ascii')
        LOGGER.warning(
            'Config encryption key auto-generated. Set '
            'IMBI_CONFIG_ENCRYPTION_KEY in production for a stable key '
            'across restarts.'
        )
    return self

def configure(self) -> None:
    """Configure the default SSL context if cert_dir is set.

    Patches ssl.create_default_context and
    ssl._create_default_https_context to load CA certificates from
    cert_dir on every call.
    """
    if self.cert_dir is None:
        return
    import ssl

    cert_dir = str(self.cert_dir)
    _orig = ssl.create_default_context

    def _patched(*args: object, **kwargs: object) -> ssl.SSLContext:
        ctx = _orig(*args, **kwargs)  # type: ignore[arg-type]
        ctx.load_verify_locations(capath=cert_dir)
        return ctx

    ssl.create_default_context = _patched
    ssl._create_default_https_context = _patched