d27dd0ffbb
Close 12 audit-driven platform-compliance gaps on a single branch. - D4 dispatch: app/integrations/dispatch_client.py participant `legacyhub`, emits LegacyhubDocumentIndexed + AssetDerivativeReady after the indexing commit (idempotent uuid5), http_inbox route (reindex/tombstone) with audit-based dedupe; docs/dispatch-contract.md. Celery+Redis stays intra-module. - D2 SSO: app/integrations/identity.py validates X-TeamHub-* + role/scope mapper; security.py adds trusted-header enforcement (AUTH_REQUIRE_IDENTITY) and a scope check on /search; docker-compose.teamhub.yml (external teamhub_net + internal db net, api not host-published); RUNBOOK network/firewall section. - Asset standard: SearchHit/Citation carry asset_id/owner_module; buckets renamed teamhub-legacyhub-* (+quarantine/tmp/exports); purge-by-asset_id with legal-hold guard (app/indexing/projection.py); OCR-markdown derivative event. - audit_log model + Alembic 0003 + record_audit on writes (same transaction). - Secret masking: app/common/json_logger.py recursive mask wired into structlog (+ensure_ascii=False); event payloads redacted before persistence. - Service X-API-Key mandatory on ingest endpoints (defence-in-depth). - Port: host API 8000->8050 (collision with SalesHUB/MailHUB resolved), container still listens on 8000. - Config: no plaintext secret defaults; fail-loud in non-dev (no value leak). - Docs drift: README PG 5440, layered-auth note, 5173 removed from CORS; ingest/folder gated by ENABLE_FOLDER_INGEST (410 by default). - ADRs: layers mapping, shared-core extraction, UI locale (RU-first). Tests: 78 passing (ruff, compileall, pytest, tsc, vite build, compose config). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
72 lines
2.1 KiB
Python
72 lines
2.1 KiB
Python
"""FastAPI entrypoint."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from collections.abc import AsyncIterator
|
|
from contextlib import asynccontextmanager
|
|
|
|
from fastapi import FastAPI
|
|
from fastapi.middleware.cors import CORSMiddleware
|
|
|
|
from app import __version__
|
|
from app.api import (
|
|
routes_dispatch_inbox,
|
|
routes_health,
|
|
routes_ingestion,
|
|
routes_search,
|
|
)
|
|
from app.api.security import install_api_key_auth, install_trusted_headers_auth
|
|
from app.config import settings
|
|
from app.logging_config import configure_logging, get_logger
|
|
|
|
configure_logging()
|
|
logger = get_logger(__name__)
|
|
|
|
|
|
@asynccontextmanager
|
|
async def lifespan(app: FastAPI) -> AsyncIterator[None]:
|
|
logger.info("api.startup", version=__version__, prefix=settings.app_api_prefix)
|
|
# Best-effort bootstrap of MinIO buckets - non-fatal if it fails (health will reflect).
|
|
try:
|
|
from app.storage.minio_client import get_storage
|
|
|
|
get_storage().ensure_buckets()
|
|
except Exception as exc: # noqa: BLE001
|
|
logger.warning("api.startup.minio_bootstrap_failed", error=str(exc))
|
|
yield
|
|
logger.info("api.shutdown")
|
|
|
|
|
|
app = FastAPI(
|
|
title="LegacyHUB",
|
|
description="Hybrid lexical + semantic search over legacy PDF archives",
|
|
version=__version__,
|
|
lifespan=lifespan,
|
|
)
|
|
|
|
app.add_middleware(
|
|
CORSMiddleware,
|
|
allow_origins=settings.cors_origins,
|
|
allow_credentials=True,
|
|
allow_methods=["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
|
|
allow_headers=["*", "X-API-Key", "Authorization"],
|
|
max_age=3600,
|
|
)
|
|
install_api_key_auth(app)
|
|
install_trusted_headers_auth(app)
|
|
|
|
app.include_router(routes_health.router, prefix=settings.app_api_prefix)
|
|
app.include_router(routes_ingestion.router, prefix=settings.app_api_prefix)
|
|
app.include_router(routes_search.router, prefix=settings.app_api_prefix)
|
|
app.include_router(routes_dispatch_inbox.router, prefix=settings.app_api_prefix)
|
|
|
|
|
|
@app.get("/")
|
|
def root() -> dict[str, str]:
|
|
return {
|
|
"service": "LegacyHUB",
|
|
"version": __version__,
|
|
"api": settings.app_api_prefix,
|
|
"docs": "/docs",
|
|
}
|