gtiandClaude Sonnet 5
8d6122c096
One universal Windows Agent package per version (agent_releases: version/ platform/architecture/sha256/status DRAFT|PUBLISHED|REVOKED; the binary lives on a local release-storage volume, never in PostgreSQL). An operator creates a pending installation (agent_enrollments) from Agents / Servidores -> + Nova instalação, then either downloads it directly or generates a one-time HTTPS link (short TTL, single use). Either path streams the package plus a freshly minted enrollment.json whose token is never written to storage in plaintext, only its SHA-256 hash. On the client host, gti-agent.ps1 install-auto verifies the bundle's SHA-256, refuses a non- HTTPS Hub, enrolls via POST /v1/agents/enroll (deleting the enrollment token immediately after, success or failure), writes an ACL-restricted .env with the newly issued permanent Agent token, and registers the Windows Service without starting it (Firebird stays unconfigured on purpose). Idempotent, replay-proof, rate-limited per IP, fully audited, never logs a secret. Migration 0022_agent_releases_enrollment (verified fresh-DB == upgrade-from-0021 by pg_dump diff). GTI_FISCAL_VERSION/AGENT_VERSION bumped to 1.1.0 as the single source of truth across code, packages, the release manifest and every published AgentRelease row. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
76 lines
4.7 KiB
Python
76 lines
4.7 KiB
Python
"""Environment-backed Fiscal Hub configuration."""
|
|
|
|
from dataclasses import dataclass
|
|
import os
|
|
from urllib.parse import quote
|
|
|
|
|
|
def _database_url() -> str:
|
|
configured = os.getenv("DATABASE_URL")
|
|
if configured:
|
|
return configured
|
|
password = quote(os.getenv("POSTGRES_PASSWORD", "gti"), safe="")
|
|
return f"postgresql+psycopg://gti:{password}@postgres:5432/gti_fiscal"
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class Settings:
|
|
database_url: str = _database_url()
|
|
hub_port: int = int(os.getenv("HUB_PORT", "8000"))
|
|
# AGENT_DEV_TOKEN auto-bootstraps an agent from a fixed dev token on every request.
|
|
# Leave unset in any environment other than local development — production Agents
|
|
# must be created via scripts/register_agent.py, whose token is never derived from
|
|
# this setting.
|
|
agent_dev_token: str = os.getenv("AGENT_DEV_TOKEN", "")
|
|
environment: str = os.getenv("APP_ENV", "development")
|
|
log_level: str = os.getenv("LOG_LEVEL", "INFO")
|
|
base_url: str = os.getenv("BASE_URL", "http://localhost:8000")
|
|
# An Agent is considered ONLINE if a heartbeat arrived within this many seconds.
|
|
agent_online_threshold_seconds: int = int(os.getenv("AGENT_ONLINE_THRESHOLD_SECONDS", "120"))
|
|
agent_heartbeat_interval_seconds: int = int(os.getenv("AGENT_HEARTBEAT_INTERVAL_SECONDS", "40"))
|
|
agent_offline_after_seconds: int = int(os.getenv("AGENT_OFFLINE_AFTER_SECONDS", "0"))
|
|
agent_server_version: str = os.getenv("CURRENT_SERVER_VERSION", "1.0.0rc1")
|
|
agent_event_retention_days: int = int(os.getenv("AGENT_EVENT_RETENTION_DAYS", "90"))
|
|
web_session_seconds: int = int(os.getenv("WEB_SESSION_SECONDS", "28800"))
|
|
web_cookie_secure: bool = os.getenv("WEB_COOKIE_SECURE", "0") == "1"
|
|
web_cookie_name: str = os.getenv("WEB_COOKIE_NAME", "gti_admin_session")
|
|
web_max_event_message: int = int(os.getenv("WEB_MAX_EVENT_MESSAGE", "2000"))
|
|
web_max_event_context_bytes: int = int(os.getenv("WEB_MAX_EVENT_CONTEXT_BYTES", "12000"))
|
|
ui_timezone: str = os.getenv("UI_TIMEZONE", "America/Bahia")
|
|
allow_weak_dev_password: bool = os.getenv("ALLOW_WEAK_DEV_PASSWORD", "0") == "1"
|
|
# ---- SSO from GTI Gerenciador (central/app/sso.py) ----
|
|
# Ed25519 public key (raw 32 bytes, base64url) of the panel that signs the
|
|
# assertions; the private key never exists on the Hub. SSO is active only
|
|
# when both the key and the panel's start URL are set.
|
|
sso_public_key: str = os.getenv("SSO_GERENCIADOR_CHAVE_PUBLICA", "")
|
|
sso_start_url: str = os.getenv("SSO_START_URL", "")
|
|
federated_session_seconds: int = int(os.getenv("FEDERATED_SESSION_SECONDS", "3600"))
|
|
# ---- Agent distribution (central/app/agent_distribution.py) ----
|
|
# Local, non-web-served directory holding the released Windows Agent zips.
|
|
# Never inside PostgreSQL, never under central/static.
|
|
agent_release_storage_path: str = os.getenv("AGENT_RELEASE_STORAGE_PATH", "./data/releases")
|
|
agent_download_link_ttl_seconds: int = int(os.getenv("AGENT_DOWNLOAD_LINK_TTL_SECONDS", "1800"))
|
|
agent_download_max_uses_default: int = int(os.getenv("AGENT_DOWNLOAD_MAX_USES_DEFAULT", "1"))
|
|
agent_enrollment_ttl_seconds: int = int(os.getenv("AGENT_ENROLLMENT_TTL_SECONDS", "86400"))
|
|
ncm_dataset_url: str = os.getenv("NCM_DATASET_URL", "https://portalunico.siscomex.gov.br/classif/api/publico/nomenclatura/download/json")
|
|
cest_dataset_url: str = os.getenv("CEST_DATASET_URL", "https://www.confaz.fazenda.gov.br/legislacao/convenios/2018/CV142_18")
|
|
dataset_storage_path: str = os.getenv("DATASET_STORAGE_PATH", "./data/datasets")
|
|
http_timeout_seconds: float = float(os.getenv("HTTP_TIMEOUT_SECONDS", "30"))
|
|
# ---- AI semantic layer V1 ----
|
|
# Credentials live ONLY in the Hub environment; the Windows Agent never sees them.
|
|
ai_enabled: bool = os.getenv("AI_ENABLED", "0") == "1"
|
|
ai_provider: str = os.getenv("AI_PROVIDER", "baseline") # baseline | openai | ... (AISemanticProvider)
|
|
ai_model: str = os.getenv("AI_MODEL", "baseline-deterministic-v1")
|
|
ai_max_batch_size: int = int(os.getenv("AI_MAX_BATCH_SIZE", "20"))
|
|
ai_max_run_cost_usd: float = float(os.getenv("AI_MAX_RUN_COST_USD", "5.0"))
|
|
ai_min_confidence: float = float(os.getenv("AI_MIN_CONFIDENCE", "0.6"))
|
|
ai_price_in_per_m: float | None = float(os.getenv("AI_PRICE_IN_PER_M")) if os.getenv("AI_PRICE_IN_PER_M") else None
|
|
ai_price_out_per_m: float | None = float(os.getenv("AI_PRICE_OUT_PER_M")) if os.getenv("AI_PRICE_OUT_PER_M") else None
|
|
# Real-LLM evaluation (OpenAI-compatible). The key lives ONLY in this environment.
|
|
# Z.ai general endpoint (NOT the /api/coding/paas/v4 coding-plan endpoint).
|
|
ai_api_key: str = os.getenv("AI_API_KEY", "")
|
|
ai_base_url: str = os.getenv("AI_BASE_URL", "https://api.z.ai/api/paas/v4")
|
|
|
|
|
|
settings = Settings()
|