fb8a932923
Rate-limit the optional agent bearer path after user auth resolution so mixed user/agent routes no longer leave an unthrottled PBKDF2 path. Stop logging token prefixes on agent auth failures and require a locally supplied token for backend/.env.test instead of committing one. Update tests and docs to cover agent bearer fallback, configurable webhook signature headers, and the operator-facing security settings added by the hardening work. Co-Authored-By: Claude <noreply@anthropic.com>
41 lines
1.1 KiB
Plaintext
41 lines
1.1 KiB
Plaintext
# Commit-safe backend test environment.
|
|
# Usage:
|
|
# export LOCAL_AUTH_TOKEN="$(python3 -c 'import secrets; print(secrets.token_urlsafe(48))')"
|
|
# cd backend
|
|
# uv run --env-file .env.test uvicorn app.main:app --reload --port 8000
|
|
|
|
ENVIRONMENT=dev
|
|
LOG_LEVEL=INFO
|
|
LOG_FORMAT=text
|
|
LOG_USE_UTC=false
|
|
REQUEST_LOG_SLOW_MS=1000
|
|
REQUEST_LOG_INCLUDE_HEALTH=false
|
|
|
|
# Local backend -> local Postgres (adjust host/port if needed)
|
|
DATABASE_URL=postgresql+psycopg://postgres:postgres@localhost:5432/mission_control_test
|
|
CORS_ORIGINS=http://localhost:3000
|
|
BASE_URL=http://localhost:8000
|
|
|
|
# Auth mode: local for test/dev
|
|
AUTH_MODE=local
|
|
# Set in your shell before starting the backend.
|
|
# Must be non-placeholder and >= 50 chars.
|
|
LOCAL_AUTH_TOKEN=
|
|
|
|
# Clerk settings kept empty in local auth mode
|
|
CLERK_SECRET_KEY=
|
|
CLERK_API_URL=https://api.clerk.com
|
|
CLERK_VERIFY_IAT=true
|
|
CLERK_LEEWAY=10.0
|
|
|
|
# Database
|
|
DB_AUTO_MIGRATE=true
|
|
|
|
# Queue / dispatch
|
|
RQ_REDIS_URL=redis://localhost:6379/0
|
|
RQ_QUEUE_NAME=default
|
|
RQ_DISPATCH_THROTTLE_SECONDS=15.0
|
|
RQ_DISPATCH_MAX_RETRIES=3
|
|
|
|
GATEWAY_MIN_VERSION=2026.02.9
|