22 lines
899 B
Python
22 lines
899 B
Python
"""Runtime validation for security-sensitive application settings."""
|
|
|
|
from app.config import LEGACY_DEFAULT_SECRET, Settings
|
|
|
|
|
|
def validate_runtime_settings(settings: Settings) -> None:
|
|
"""Reject unsafe settings before scheduling monitoring work."""
|
|
if settings.environment == "production":
|
|
if settings.secret_key == LEGACY_DEFAULT_SECRET:
|
|
raise ValueError("SECRET_KEY must be provided by the runtime environment")
|
|
if not settings.casdoor_endpoint.startswith("https://"):
|
|
raise ValueError("CASDOOR endpoint must use TLS in production")
|
|
|
|
if settings.wecom_notification_enabled:
|
|
credentials = (
|
|
settings.WECOM_CORP_ID,
|
|
settings.WECOM_AGENT_ID,
|
|
settings.WECOM_APP_SECRET,
|
|
)
|
|
if not all(credentials):
|
|
raise ValueError("WECOM delivery requires corp ID, agent ID, and app secret")
|