NuklearRabbit
b79d485ef1
Inspected the shared n8n instance (n8n.itworx.tech) live: both existing Fleet Ops workflows are genuinely active and structurally match the repo, but the shared X-Service-Token secret was stored as plaintext literal text in both HTTP Request nodes (exportable in the clear), and the production return webhook had n8n-level Authentication set to "None" (publicly callable by anyone who discovered the URL). Findings recorded in docs/live-ai-integration/n8n-current-state.md. Fixed on the n8n side (both workflows published): the shared token now lives in a single Header Auth credential instead of two literal copies; the return webhook now requires a second, distinct Header Auth credential. Fixed on the Fleet Ops side to match: the outbox dispatcher now sends the new X-Fleet-Ops-Trigger-Token header (new MOBILITYOPS_WEBHOOK_TRIGGER_TOKEN setting) when calling the webhook. Live-verified against the real webhook: a request with no header is now rejected (403); a request with the correct header passes n8n's auth and reaches Fleet Ops's own business logic. That same live test also surfaced a real robustness gap: an n8n execution that errors before its "Respond to Webhook" node runs can still answer with a 2xx status and an empty body, which made response.json() raise an uncaught exception, potentially leaving the outbox event stuck in "delivering". Now treated as an explicit, retryable failure (error_code=malformedResponse), with a regression test reproducing the exact case.
50 lines
2.1 KiB
Python
50 lines
2.1 KiB
Python
from functools import lru_cache
|
|
|
|
from pydantic_settings import BaseSettings, SettingsConfigDict
|
|
|
|
# The visible product name is fixed and never translated or configured per-deployment --
|
|
# see docs/fleet-ops-correction/current-gap-audit.md section 1. Internal identifiers
|
|
# (package name, Compose project, database name, repository) intentionally remain
|
|
# "mobilityops"; this constant is only for user-facing surfaces (e.g. the OpenAPI title).
|
|
PRODUCT_NAME = "Fleet Ops"
|
|
|
|
|
|
class Settings(BaseSettings):
|
|
model_config = SettingsConfigDict(env_file=".env", extra="ignore")
|
|
|
|
mobilityops_env: str = "development"
|
|
mobilityops_demo_mode: bool = True
|
|
database_url: str = "postgresql+psycopg://mobilityops:mobilityops@db:5432/mobilityops"
|
|
knowledge_provider: str = "demo"
|
|
ragcore_base_url: str = "http://ragcore-api:8000"
|
|
ragcore_tenant: str = "northstar-mobility-demo"
|
|
ragcore_workspace: str = "mobilityops"
|
|
ragcore_collection: str = "internal-procedures"
|
|
ragcore_api_token: str = ""
|
|
ragcore_http_timeout_seconds: float = 5.0
|
|
n8n_webhook_url: str = "http://n8n:5678/webhook/mobilityops-return"
|
|
n8n_webhook_trigger_token: str = "replace-me-n8n-webhook-trigger-token"
|
|
n8n_callback_token: str = "replace-me-n8n-callback-token"
|
|
n8n_dispatch_enabled: bool = True
|
|
n8n_dispatch_interval_seconds: float = 3.0
|
|
n8n_http_timeout_seconds: float = 5.0
|
|
n8n_max_attempts: int = 5
|
|
n8n_delivery_lease_seconds: float = 120.0
|
|
app_secret: str = "replace-in-production"
|
|
session_cookie_name: str = "mobilityops_session"
|
|
session_ttl_seconds: int = 60 * 60 * 8
|
|
session_cookie_secure: bool = False
|
|
seed_dir: str = "/app/seed"
|
|
knowledge_dir: str = "/app/knowledge/procedures"
|
|
mcp_hub_service_token: str = "replace-me-mcp-hub-token"
|
|
mcp_hub_registration_enabled: bool = False
|
|
cors_allow_origins: str = "http://localhost:1228"
|
|
demo_organization_name: str = "Northstar Mobility"
|
|
demo_timezone: str = "Europe/Brussels"
|
|
demo_allow_reset: bool = True
|
|
|
|
|
|
@lru_cache
|
|
def get_settings() -> Settings:
|
|
return Settings()
|