TudorandClaude Opus 5
0fa1a292c7
PR Checks / Frontend Typecheck + Tests (pull_request) Successful in 1m3s
PR Checks / Backend Smoke (pull_request) Successful in 8s
PR Checks / Build Backend (no push) (pull_request) Successful in 18s
PR Checks / Build Frontend (no push) (pull_request) Successful in 45s
PR Checks / Build Pipeline (no push) (pull_request) Successful in 10s
PR Checks / AI Code Review (Claude) (pull_request) Successful in 10s
Code review, both findings valid. The design doc claimed Cloudflare "replaces the header, so a browser cannot forge it", and that only the X-Forwarded-For fallback was forgeable. That is true only for traffic that actually passed through Cloudflare, and nothing in this process can verify that it did. Reaching the origin directly, both headers are equally attacker-controlled — and rotating CF-Connecting-IP mints a fresh rate-limit bucket per request, defeating per-client limits on every endpoint including the DataFrame-heavy /api/schools. Against abuse that is worse than the shared bucket it replaced, which at least capped everyone together. So the ceiling comes back. I dropped it earlier arguing it belonged at Cloudflare; that argument assumed the keying was sound, and it is not. GlobalRateLimitMiddleware counts all /api/ traffic in a fixed window against a total, independent of client identity, outermost so it refuses before any work happens. Written by hand because slowapi cannot express a global cap: default_limits and application_limits are both keyed by key_func, and the latter needs middleware this app does not install. It does not make the header trustworthy — it makes trusting it survivable. The real fix is Authenticated Origin Pulls or an origin firewall, now documented in DEPLOY.md as the open gap it is. 127.0.0.1 is exempt: the healthcheck curls localhost from inside the container, and starving it would restart the container and turn a load spike into an outage loop. Keyed on the peer address, never the Host header, which the caller sets. Second finding: suggest_schools_typesense promised "never raises" while the parsing loop sat outside the try, so int(None) on a malformed document would have made a keystroke a 500. The loop now skips bad rows rather than dropping the whole list — and a hit with no document no longer becomes a suggestion pointing at /school/0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj
72 lines
2.4 KiB
Python
72 lines
2.4 KiB
Python
"""
|
|
Application configuration using pydantic-settings.
|
|
Loads from environment variables and .env file.
|
|
"""
|
|
|
|
import secrets
|
|
from pathlib import Path
|
|
from typing import List, Optional
|
|
from pydantic_settings import BaseSettings
|
|
from pydantic import Field
|
|
|
|
|
|
class Settings(BaseSettings):
|
|
"""Application settings loaded from environment."""
|
|
|
|
# Paths
|
|
data_dir: Path = Path(__file__).parent.parent / "data"
|
|
frontend_dir: Path = Path(__file__).parent.parent / "frontend"
|
|
|
|
# Server
|
|
host: str = "0.0.0.0"
|
|
port: int = 80
|
|
debug: bool = False # Set to False in production
|
|
|
|
# Database
|
|
database_url: str = "postgresql://schoolcompare:schoolcompare@localhost:5432/schoolcompare"
|
|
|
|
# CORS - Production should only allow the actual domain
|
|
allowed_origins: List[str] = ["https://schoolcompare.co.uk"]
|
|
|
|
# API
|
|
default_page_size: int = 50
|
|
max_page_size: int = 100
|
|
|
|
# Security
|
|
admin_api_key: str = Field(default_factory=lambda: secrets.token_urlsafe(32))
|
|
rate_limit_per_minute: int = 60 # Requests per minute per IP
|
|
# A ceiling on total /api/ traffic, independent of any client identity.
|
|
# client_key trusts headers only Cloudflare can vouch for, so a caller
|
|
# reaching the origin directly could otherwise mint a fresh bucket per
|
|
# request. See GlobalRateLimitMiddleware in backend/app.py.
|
|
global_rate_limit_per_minute: int = 3000
|
|
rate_limit_burst: int = 10 # Allow burst of requests
|
|
max_request_size: int = 1024 * 1024 # 1MB max request size
|
|
|
|
# Typesense
|
|
typesense_url: str = "http://localhost:8108"
|
|
typesense_api_key: str = ""
|
|
|
|
# Feature flags (Unleash). An empty unleash_url disables flags entirely and
|
|
# every flag evaluates False — the correct behaviour for local development
|
|
# and CI, and the reason no test needs a running Unleash.
|
|
unleash_url: str = ""
|
|
unleash_api_token: str = ""
|
|
unleash_app_name: str = "schoolcompare-backend"
|
|
# On a named volume, so a restart during an Unleash outage keeps
|
|
# last-known state instead of reverting a released feature to dark.
|
|
unleash_cache_directory: str = "/app/.unleash"
|
|
|
|
# Analytics
|
|
ga_measurement_id: Optional[str] = "G-J0PCVT14NY" # Google Analytics 4 Measurement ID
|
|
|
|
class Config:
|
|
env_file = ".env"
|
|
env_file_encoding = "utf-8"
|
|
extra = "ignore"
|
|
|
|
|
|
# Singleton instance
|
|
settings = Settings()
|
|
|