import pathlib from typing import Any, Literal, Self from cryptography.hazmat.backends import default_backend from cryptography.hazmat.primitives import serialization from fansifter_common.adapters.aws.secretsmanager import SecretsManager from fansifter_common.adapters.snowflake.converter import SnowflakeConverter from fansifter_common.constants import PROD_ENVIRONMENT, QA_ENVIRONMENT from fansifter_common.utils.functional import lazy_proxy from pydantic import ( Field, SecretStr, ValidationError, model_validator, ) from pydantic_settings import BaseSettings, SettingsConfigDict class Settings(BaseSettings): environment: str debug: bool = Field(validation_alias="APP_DEBUG", default=False) service_name: str = "lambda-audience-sendgrid-webhooks-inbound" service_version: str = "0.1.0" aws_region_name: str = "us-east-1" # Kafka kafka_bootstrap_servers: str = "localhost" kafka_sendgrid_inbound_topic: str = "event.sendgrid.webhook.inbound" kafka_sendgrid_reply_topic: str = "event.sendgrid.webhook.fanResponse" kafka_use_ssl: bool = False @property def kafka_servers(self) -> list[str]: return self.kafka_bootstrap_servers.split(",") @model_validator(mode="after") def _kafka_use_ssl(self) -> Self: if self.environment in [QA_ENVIRONMENT, PROD_ENVIRONMENT]: self.kafka_use_ssl = True return self # Redis redis_host: str = "localhost" redis_port: int = 6379 redis_db: int = 0 redis_ssl: bool = False @model_validator(mode="after") def _setup_redis_ssl(self) -> Self: if self.environment in [QA_ENVIRONMENT, PROD_ENVIRONMENT]: self.redis_ssl = True return self @property def reply_redis_cache_key_template(self) -> str: return f"{self.service_name}:reply:{{email_id}}:{{sender_email_hash}}" reply_requests_count_limit: int = 5 reply_requests_count_reset_seconds: int = 3600 failed_events_s3_bucket: str = "qa-sendgrid-webhooks-dead-letter-events" ows_client_timeout: int = 60 default_forward_email: str = "fansifter-dev@sonymusic-pde.com" from_email_domain: str = "email.qa-fansifter.theorchard.io" accounts_to_forward_on_qa_env: list[int] = [7123] @property def from_email_template(self) -> str: return f"fan-reply-{{unique_part}}@{self.from_email_domain}" reply_to_secret_key: str = "" reply_to_secret_key_name: str = "reply_to_secret_key_name" @model_validator(mode="after") def _setup_reply_to_secret_key(self) -> Self: if not self.reply_to_secret_key and self.environment in [ QA_ENVIRONMENT, PROD_ENVIRONMENT, ]: secrets_manager = SecretsManager(region_name=self.aws_region_name) self.reply_to_secret_key = secrets_manager.get_secret( self.reply_to_secret_key_name ) return self # Sendgrid sendgrid_api_key: str = "" sendgrid_sme_api_key_secret_name: str = "" sendgrid_timeout: int = 10 @model_validator(mode="after") def _setup_sendgrid_api_key(self) -> Self: if self.environment in [QA_ENVIRONMENT, PROD_ENVIRONMENT]: secrets_manager = SecretsManager(region_name=self.aws_region_name) self.sendgrid_api_key = secrets_manager.get_secret( self.sendgrid_sme_api_key_secret_name ) return self # Snowflake settings snowflake_account: str = "account" snowflake_database: str = "database" snowflake_schema: str = "schema" snowflake_warehouse: str = "warehouse" snowflake_role: str = "role" snowflake_user: str = "user" snowflake_password: SecretStr | None = None snowflake_host: str = "localhost" snowflake_port: int = 443 snowflake_url: str = "" @model_validator(mode="after") def _setup_snowflake_url(self) -> Any: from snowflake.sqlalchemy import URL # type: ignore[reportMissingTypeStubs] self.snowflake_url = URL( account=self.snowflake_account, user=self.snowflake_user, database=self.snowflake_database, schema=self.snowflake_schema, warehouse=self.snowflake_warehouse, role=self.snowflake_role, client_session_keep_alive=True, ) return self # Snowflake pool settings snowflake_echo: bool = False snowflake_pool_size: int = 10 snowflake_pool_max_overflow: int = 20 snowflake_pool_recycle: int = 4 * 55 * 60 # ~4 hours snowflake_pool_pre_ping: bool = False snowflake_pool_reset_on_return: Literal["commit", "rollback"] | None = None default_snowflake_private_key_path: pathlib.Path = ( pathlib.Path.home() / ".ssh/snowflake/rsa_key.p8" ) snowflake_private_key_path: pathlib.Path = default_snowflake_private_key_path snowflake_private_key: bytes = b"" snowflake_key_passphrase: bytes = b"" # Snowflake private key secrets snowflake_private_key_secret_name: str = "private_key_secret_name" snowflake_key_passphrase_secret_name: str = "key_passphrase_secret_name" snowflake_connect_args: dict[str, Any] = { "converter_class": SnowflakeConverter, } @model_validator(mode="after") def _setup_snowflake_connect_args(self) -> Self: if self.environment == "test": return self # Load private key if not set and path exists if not self.snowflake_private_key and self.snowflake_private_key_path.exists(): self.snowflake_private_key = self.snowflake_private_key_path.read_bytes() # Set private key and passphrase from secrets manager in QA and PROD environments if self.environment in (QA_ENVIRONMENT, PROD_ENVIRONMENT): secrets_manager = SecretsManager(region_name=self.aws_region_name) self.snowflake_private_key = secrets_manager.get_secret( self.snowflake_private_key_secret_name ).encode() self.snowflake_key_passphrase = secrets_manager.get_secret( self.snowflake_key_passphrase_secret_name ).encode() # Load private key if self.snowflake_private_key: pem_private_key = serialization.load_pem_private_key( self.snowflake_private_key, password=self.snowflake_key_passphrase if self.snowflake_key_passphrase else None, backend=default_backend(), ) private_key = pem_private_key.private_bytes( encoding=serialization.Encoding.DER, format=serialization.PrivateFormat.PKCS8, encryption_algorithm=serialization.NoEncryption(), ) self.snowflake_connect_args["private_key"] = private_key return self # Logging logging_debug: bool = Field(validation_alias="LOGGING_DEBUG", default=False) @property def logging_config(self) -> dict[str, Any]: return { "version": 1, "disable_existing_loggers": True, "formatters": { "json": { "()": "owslogger.logger.DDJsonFormatter", "service_name": self.service_name, "service_version": self.service_version, "env": self.environment, }, "console": { "()": "fansifter_common.logging.ConsoleFormatter", }, }, "filters": { "require_debug_true": { "()": "fansifter_common.logging.RequireDebugTrueFilter", "value": self.logging_debug, }, "require_debug_false": { "()": "fansifter_common.logging.RequireDebugFalseFilter", "value": self.logging_debug, }, }, "handlers": { "stream": { "level": "INFO", "class": "logging.StreamHandler", "formatter": "json", "filters": ["require_debug_false"], }, "rich": { "level": "INFO", "class": "rich.logging.RichHandler", "filters": ["require_debug_true"], "formatter": "console", }, }, "loggers": { "app": { "handlers": ["stream", "rich"], "level": "INFO", "propagate": False, }, "httpx": { "handlers": ["stream", "rich"], "level": "WARNING", "propagate": False, }, "sqlalchemy.engine": { "handlers": ["stream", "rich"], "level": "WARNING", "propagate": False, }, }, } @property def m2m_token_secret_key_name(self) -> str: return f"{self.environment}/lambda-audience-refresh-m2m-token/m2m_token" @property def m2m_token_secret_expiry_key_name(self) -> str: return ( f"{self.environment}/lambda-audience-refresh-m2m-token/m2m_token_expiration" ) # Sentry sentry_dsn: str | None = None @model_validator(mode="after") def _setup_sentry_dsn(self) -> Self: if not self.sentry_dsn and self.environment in [ QA_ENVIRONMENT, PROD_ENVIRONMENT, ]: raise ValueError(f"Sentry is not configured in {self.environment}.") return self model_config = SettingsConfigDict( env_file=".env", env_file_encoding="utf-8", case_sensitive=False, extra="allow", ) def initialize_settings(**defaults: Any) -> Settings: try: return Settings(**defaults) except ValidationError as exc: errors = "\n".join( [ f" * {'.'.join(map(str, error['loc']))} - {error['msg']}" for error in exc.errors() ] ) raise RuntimeError(f"Failed to initialize settings:\n {errors}") from exc # Lazy proxy for settings settings = lazy_proxy(initialize_settings)