Реализованы сервисы ВМ2 - проверка сообщений и синхронизация с Б24 (деплой еще без перевода в боевой режим)

codebase/backend/api-backend/app/settings.py

@@ -1,6 +1,7 @@
 from functools import lru_cache
+from typing import Literal
 
-from pydantic import AnyHttpUrl, Field, SecretStr
+from pydantic import AnyHttpUrl, Field, SecretStr, model_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
@@ -25,6 +26,10 @@ class Settings(BaseSettings):
 
     message_safety_url: AnyHttpUrl = Field(alias="MESSAGE_SAFETY_URL")
     message_safety_service_token: SecretStr = Field(alias="MESSAGE_SAFETY_SERVICE_TOKEN")
+    message_safety_ca_file: str | None = Field(default=None, alias="MESSAGE_SAFETY_CA_FILE")
+    message_safety_api_prefix: Literal["/internal/safety/v2"] = Field(
+        default="/internal/safety/v2", alias="MESSAGE_SAFETY_API_PREFIX"
+    )
     message_safety_post_timeout_sec: float = Field(
         default=5, alias="MESSAGE_SAFETY_POST_TIMEOUT_SEC"
     )
@@ -71,6 +76,15 @@ class Settings(BaseSettings):
         default=None, alias="NOTIFICATIONS_TOKEN_PRODUCER_TEST"
     )
 
+    @model_validator(mode="after")
+    def require_safety_tls_in_deployed_environments(self) -> "Settings":
+        if self.app_env not in {"local", "test"}:
+            if str(self.message_safety_url).split(":", 1)[0] != "https":
+                raise ValueError("MESSAGE_SAFETY_URL must use HTTPS")
+            if not self.message_safety_ca_file:
+                raise ValueError("MESSAGE_SAFETY_CA_FILE is required")
+        return self
+
     @property
     def issuer(self) -> str:
         return f"{str(self.keycloak_public_url).rstrip('/')}/realms/{self.keycloak_realm}"