Feat/backend config

[shantanushok]

Description

Resolves #917

Added centralized configuration validation via pydantic-settings. This ensures that all environment variables (e.g. paths, ports, and limits) are strictly typed and validated on application startup instead of relying on scattered os.getenv calls with missing validation.

Summary of Changes

• backend/utils/config.py:

  • Created a centralized Settings class inheriting from BaseSettings.
  • Defined strongly-typed fields for all environment variables (frontend_dist, cors_origins, upload_dir, etc.) along with their default fallbacks.

• backend/app.py:

  • Hooked up settings.frontend_dist and settings.cors_origins.

• backend/utils/audit_log.py:

  • Configured AUDIT_LOG_DIR to use settings.audit_log_dir.

• backend/services/rag_service.py:

  • Replaced direct env fetch for CHROMA_PATH with settings.chromadb_dir.

• backend/services/ollama_service.py:

  • Updated OLLAMA_BASE_URL retrieval to use settings.ollama_host.

• backend/services/db_service.py:

  • Updated VACUUM_THRESHOLD and DB_PATH to use the validated settings.
  • Replaced the hardcoded default "llama3" DB seed with settings.default_model.

• backend/routes/upload.py:

  • Configured UPLOAD_DIR via settings and tied the 50MB upload limit to settings.max_file_size.

• backend/routes/settings.py:

  • Removed manual float/integer parsing logic for settings_api_timeout_seconds since Pydantic handles this validation natively.

Verification

Ran the full backend test suite to verify no regressions in routes or services:

python -m pytest backend/tests

[vercel]

@shantanushok is attempting to deploy a commit to the Darshan's projects Team on Vercel.

A member of the Team first needs to authorize it.

[Copilot]

Pull request overview

This PR introduces a centralized backend configuration module (backend/utils/config.py) using pydantic-settings to replace scattered os.getenv usage, and wires the validated settings into core backend entrypoints (app startup, DB, RAG, uploads, and services).

Changes:

• Added a Settings (BaseSettings) wrapper for key environment variables (paths, ports, limits, defaults).
• Replaced direct environment lookups in app/service/route modules with settings.* accessors.
• Simplified settings timeout parsing by delegating type coercion to Pydantic.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
backend/utils/config.py	New centralized settings object and defaults (env-backed).
backend/app.py	Uses settings for frontend dist path and CORS/CSRF allowlist origins.
backend/utils/audit_log.py	Sources audit log directory from validated settings.
backend/services/rag_service.py	Sources ChromaDB directory from validated settings.
backend/services/ollama_service.py	Sources Ollama host/base URL from validated settings.
backend/services/db_service.py	Sources DB path/vacuum threshold from settings; updates seed default_model.
backend/routes/upload.py	Uses settings for upload directory and max upload size.
backend/routes/settings.py	Removes manual env parsing for settings timeout and uses settings.

Suppressed comments (3)

backend/utils/config.py:4

• Unused import: List from typing is not referenced in this module.

from pydantic_settings import BaseSettings, SettingsConfigDict
from pydantic import Field
from typing import List
from pathlib import Path

backend/utils/config.py:10

• SETTINGS_API_TIMEOUT_SECONDS previously allowed floats (the route code parsed float(os.getenv(...))). With settings_api_timeout_seconds: int, values like "0.5" will now fail validation and crash at import/startup. Consider making this a float and aligning the default with DEFAULT_SETTINGS_API_TIMEOUT_SECONDS (2.0) in routes/settings.py.

    settings_api_timeout_seconds: int = Field(default=10, alias="SETTINGS_API_TIMEOUT_SECONDS")

backend/utils/config.py:8

• Issue #917 / PR description call out config validation for the security middleware allowlist, but cors_origins is still an unvalidated comma-separated string. This means malformed origins (missing scheme/host) will pass through to CORS + OriginValidationMiddleware without startup-time validation.

    cors_origins: str = Field(default="http://localhost:3000,http://127.0.0.1:3000,http://localhost:5173,http://localhost:8000", alias="CORS_ORIGINS")

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[shantanushok]

@imDarshanGK can you please merge this :]

[shantanushok]

Hey @imDarshanGK can you review this please..