bvandeusen
da511fcc9f
Dashboard: - 'Done recently' chip-cloud -> compact uniform list (Active-now row style), showing 5 with inline expand to the rest (backend already returns up to 8). - New 'Projects' rail card: each active project with 'N open · M done'. Backend already computed done_count (dashboard.py) — now surfaced in the /api/dashboard payload per active project. MCP Access (Connect Claude / Claude Code): - Progressive disclosure: lead with the pre-filled plugin-install snippet; fold server name, scope, marketplace URL, and the MCP-only path into a single 'Customize' expander. Desktop tab keeps its own server-name field. - Marketplace URL now defaults to this instance's own repo via config.PLUGIN_MARKETPLACE_URL (env-overridable); /api/plugin/marketplace-url falls back to it, so the field + install snippet are pre-filled out of the box instead of showing a generic placeholder. Refs #761 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
88 lines
4.2 KiB
Python
88 lines
4.2 KiB
Python
import os
|
|
|
|
|
|
def _read_secret(env_var: str, secret_file_var: str, default: str) -> str:
|
|
"""Read a config value from env var, or from a Docker secrets file."""
|
|
value = os.environ.get(env_var)
|
|
if value:
|
|
return value
|
|
secret_file = os.environ.get(secret_file_var)
|
|
if secret_file:
|
|
try:
|
|
with open(secret_file) as f:
|
|
return f.read().strip()
|
|
except FileNotFoundError:
|
|
pass
|
|
return default
|
|
|
|
|
|
class Config:
|
|
DATABASE_URL: str = _read_secret(
|
|
"DATABASE_URL",
|
|
"DATABASE_URL_FILE",
|
|
"postgresql+asyncpg://scribe:scribe@localhost:5432/scribe",
|
|
)
|
|
SECRET_KEY: str = _read_secret("SECRET_KEY", "SECRET_KEY_FILE", "dev-secret-change-me")
|
|
SECURE_COOKIES: bool = os.environ.get("SECURE_COOKIES", "").lower() in ("1", "true", "yes")
|
|
LOG_LEVEL: str = os.environ.get("LOG_LEVEL", "INFO")
|
|
LOG_RETENTION_DAYS: int = int(os.environ.get("LOG_RETENTION_DAYS", "90"))
|
|
|
|
# SMTP defaults (overridden by DB settings when configured via admin UI)
|
|
SMTP_HOST: str = os.environ.get("SMTP_HOST", "")
|
|
SMTP_PORT: int = int(os.environ.get("SMTP_PORT", "587"))
|
|
SMTP_USERNAME: str = os.environ.get("SMTP_USERNAME", "")
|
|
SMTP_PASSWORD: str = _read_secret("SMTP_PASSWORD", "SMTP_PASSWORD_FILE", "")
|
|
SMTP_FROM_ADDRESS: str = os.environ.get("SMTP_FROM_ADDRESS", "")
|
|
SMTP_FROM_NAME: str = os.environ.get("SMTP_FROM_NAME", "Fabled Scribe")
|
|
SMTP_USE_TLS: bool = os.environ.get("SMTP_USE_TLS", "true").lower() in ("1", "true", "yes")
|
|
BASE_URL: str = os.environ.get("BASE_URL", "http://localhost:5000").rstrip("/")
|
|
TRUST_PROXY_HEADERS: bool = os.environ.get("TRUST_PROXY_HEADERS", "").lower() in ("1", "true", "yes")
|
|
|
|
# Git URL of the repo that ships this Scribe plugin. There is one correct
|
|
# value per deployment (the repo serving the plugin), so it's a config
|
|
# default — not something each user types. Surfaced in Settings → MCP Access
|
|
# as the default install-command marketplace; an admin can still override it
|
|
# per-instance via the Plugin marketplace setting.
|
|
PLUGIN_MARKETPLACE_URL: str = os.environ.get(
|
|
"PLUGIN_MARKETPLACE_URL",
|
|
"https://git.fabledsword.com/bvandeusen/FabledScribe.git",
|
|
)
|
|
|
|
# OIDC / OAuth2 SSO (e.g. Authentik)
|
|
OIDC_ISSUER: str = os.environ.get("OIDC_ISSUER", "")
|
|
OIDC_CLIENT_ID: str = os.environ.get("OIDC_CLIENT_ID", "")
|
|
OIDC_CLIENT_SECRET: str = _read_secret("OIDC_CLIENT_SECRET", "OIDC_CLIENT_SECRET_FILE", "")
|
|
OIDC_SCOPES: str = os.environ.get("OIDC_SCOPES", "openid profile email")
|
|
LOCAL_AUTH_ENABLED: bool = os.environ.get("LOCAL_AUTH_ENABLED", "true").lower() not in ("0", "false", "no")
|
|
|
|
# SearXNG web search (external instance). Currently only surfaced via
|
|
# /api/settings/search for the Integrations tab's status indicator —
|
|
# the MCP layer doesn't proxy web search (Claude has its own).
|
|
SEARXNG_URL: str = os.environ.get("SEARXNG_URL", "")
|
|
|
|
@classmethod
|
|
def oidc_enabled(cls) -> bool:
|
|
return bool(cls.OIDC_ISSUER and cls.OIDC_CLIENT_ID and cls.OIDC_CLIENT_SECRET)
|
|
|
|
@classmethod
|
|
def searxng_enabled(cls) -> bool:
|
|
return bool(cls.SEARXNG_URL)
|
|
|
|
@classmethod
|
|
def validate(cls) -> None:
|
|
"""Validate critical config values at startup. Raises ValueError on misconfiguration."""
|
|
errors: list[str] = []
|
|
if cls.LOG_RETENTION_DAYS < 1:
|
|
errors.append(f"LOG_RETENTION_DAYS={cls.LOG_RETENTION_DAYS} must be >= 1")
|
|
if not (1 <= cls.SMTP_PORT <= 65535):
|
|
errors.append(f"SMTP_PORT={cls.SMTP_PORT} must be between 1 and 65535")
|
|
if cls.oidc_enabled() and not cls.BASE_URL.startswith(("http://", "https://")):
|
|
errors.append(f"BASE_URL='{cls.BASE_URL}' must start with http:// or https:// when OIDC is enabled")
|
|
if cls.SECRET_KEY == "dev-secret-change-me" and cls.SECURE_COOKIES:
|
|
errors.append(
|
|
"SECRET_KEY is set to the insecure default but SECURE_COOKIES=true indicates "
|
|
"a production deployment. Set SECRET_KEY or SECRET_KEY_FILE before starting."
|
|
)
|
|
if errors:
|
|
raise ValueError("Configuration errors:\n" + "\n".join(f" - {e}" for e in errors))
|