refactor!: restore platform-service-framework compliance

Author: pmflanagan

.github/workflows/framework-validation.yml

@@ -0,0 +1,23 @@
+---
+name: Framework Validation
+on:
+  pull_request:
+  push:
+    branches:
+      - devel
+      - main
+      - 'stable**'
+      - 'release**'
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+      - name: Install uv
+        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7
+      - name: Validate framework
+        run: |
+          BRANCH="${{ github.event.pull_request.base.ref || github.ref_name }}"
+          ORG="${{ github.event.pull_request.base.repo.owner.login || github.repository_owner }}"
+          uvx --refresh git+https://github.com/${ORG}/platform-service-framework@${BRANCH} validate

apps/core/segment_utils.py

@@ -0,0 +1,79 @@
+"""Segment analytics key loading utilities.
+
+This module provides functions to load the SEGMENT_WRITE_KEY from a file
+in the production environment. The key file is typically installed by
+the pipeline at /etc/ansible-automation-platform/metrics/segment-write-key.
+"""
+
+import logging
+import os
+from pathlib import Path
+
+logger = logging.getLogger(__name__)
+
+
+def read_segment_key_from_path(path: Path) -> str | None:
+    """Read SEGMENT_WRITE_KEY from a single file. Returns the key or None.
+
+    Pipeline passes build secret metrics-service-segment-write-keys (SEGMENT_WRITE_KEY_DEV for
+    PR/devel, SEGMENT_WRITE_KEY_PROD for GA); one key is installed into that path.
+    File content is the raw plaintext key (no encoding).
+
+    Args:
+        path: Path to the segment write key file
+
+    Returns:
+        The segment write key as a string, or None if the file doesn't exist or is empty
+    """
+    try:
+        if not path.is_file():
+            return None
+        key = path.read_text().strip()
+        return key if key else None
+    except OSError as e:
+        filename = getattr(e, "filename", path)
+        logger.error(
+            "Failed to read segment write key from %s: %s",
+            filename,
+            e,
+            exc_info=True,
+        )
+        return None
+
+
+def load_segment_write_key_from_file(
+    path: Path | None = None,
+    dynaconf_instance=None,
+) -> None:
+    """Load SEGMENT_WRITE_KEY from file and set on Dynaconf.
+
+    Used at module load and in tests. Respects environment variable and settings
+    precedence: does not overwrite if already set.
+
+    Args:
+        path: Path to the segment write key file. If None, uses METRICS_SERVICE_SEGMENT_WRITE_KEY_FILE
+              environment variable or defaults to /etc/ansible-automation-platform/metrics/segment-write-key
+        dynaconf_instance: The Dynaconf instance to set the key on. If None, no action is taken
+                          (caller should pass the instance from their settings context)
+    """
+    if path is None:
+        _segment_write_key_path = os.environ.get(
+            "METRICS_SERVICE_SEGMENT_WRITE_KEY_FILE",
+            "/etc/ansible-automation-platform/metrics/segment-write-key",
+        )
+        path = Path(_segment_write_key_path)
+
+    if dynaconf_instance is None:
+        return
+
+    # Respect env/settings precedence: do not overwrite if already set
+    if os.environ.get("METRICS_SERVICE_SEGMENT_WRITE_KEY", "").strip():
+        return
+    if dynaconf_instance.get("SEGMENT_WRITE_KEY"):
+        return
+    if not path.exists():
+        return
+
+    key = read_segment_key_from_path(path)
+    if key:
+        dynaconf_instance.set("SEGMENT_WRITE_KEY", key)

apps/settings/defaults.py

@@ -7,6 +7,8 @@
 
 from dynaconf import Dynaconf, post_hook
 
+from apps.core.segment_utils import load_segment_write_key_from_file
+
 # Extra applications added after PSF templating
 extra_applications = [
     "django_prometheus",
@@ -147,3 +149,71 @@ def load_prometheus_middlewares(settings: Dynaconf) -> dict:
         "django_prometheus.middleware.PrometheusAfterMiddleware",
     ]
     return {"MIDDLEWARE": new}
+
+
+@post_hook
+def load_segment_key(settings: Dynaconf) -> dict:
+    """Load Segment write key from file if not already set via environment or settings.
+
+    Hook runs after all settings are loaded, allowing file-based key loading
+    to work in production while respecting environment variable precedence.
+    """
+    load_segment_write_key_from_file(dynaconf_instance=settings)
+    return {}
+
+
+@post_hook
+def parse_allowed_hosts(settings: Dynaconf) -> dict:
+    """Parse ALLOWED_HOSTS from environment variable."""
+    import json
+    import logging
+    import os
+
+    raw = os.environ.get("METRICS_SERVICE_ALLOWED_HOSTS", "").strip()
+    if not raw:
+        return {}
+
+    if raw.startswith("["):
+        # JSON array format
+        try:
+            parsed = json.loads(raw)
+        except (json.JSONDecodeError, TypeError) as e:
+            logging.getLogger(__name__).warning(
+                "METRICS_SERVICE_ALLOWED_HOSTS: invalid JSON (%s), using empty list: %s",
+                type(e).__name__,
+                e,
+            )
+            parsed = []
+        if not isinstance(parsed, list):
+            logging.getLogger(__name__).warning(
+                "METRICS_SERVICE_ALLOWED_HOSTS: expected JSON array, got %s, using empty list",
+                type(parsed).__name__,
+            )
+            parsed = []
+        allowed_hosts = [str(x).strip() for x in parsed if str(x).strip()]
+    else:
+        # Comma-separated format
+        allowed_hosts = [str(x).strip() for x in raw.split(",") if x.strip()]
+
+    return {"ALLOWED_HOSTS": allowed_hosts}
+
+
+@post_hook
+def normalize_postgresql_options(settings: Dynaconf) -> dict:
+    """Normalize PostgreSQL session parameters for installer-friendly configuration.
+
+    Allows installers to set e.g. METRICS_SERVICE_DATABASES__awx__OPTIONS__datestyle=iso, mdy
+    without needing to know the psycopg2-specific OPTIONS__options=-c datestyle=... syntax.
+    """
+    PG_SESSION_PARAMS = {"datestyle", "search_path", "timezone", "application_name"}
+    databases = settings.get("DATABASES", {})
+
+    for db_conf in databases.values():
+        opts = db_conf.get("OPTIONS", {})
+        session_params = {k: opts.pop(k) for k in list(opts) if k.lower() in PG_SESSION_PARAMS}
+        if session_params:
+            existing = opts.get("options", "")
+            new = " ".join(f"-c {k}={v.replace(' ', '')}" for k, v in session_params.items())
+            opts["options"] = f"{existing} {new}".strip()
+
+    return {"DATABASES": databases}

apps/settings/production.py

@@ -34,7 +34,10 @@
 Validators are registered in metrics_service/settings.py and run during export().
 """
 
-from dynaconf import Validator
+import copy
+import os
+
+from dynaconf import Dynaconf, Validator, post_hook
 
 validators = []
 
@@ -265,3 +268,23 @@
         },
     ),
 )
+
+
+@post_hook
+def configure_json_logging(settings: Dynaconf) -> dict:
+    """Configure JSON logging for production environments.
+
+    Enables JSON-formatted logs when in production mode or when METRICS_SERVICE_LOG_FORMAT=json.
+    This provides container-friendly structured logging for production deployments.
+    """
+    environment = os.environ.get("METRICS_SERVICE_MODE", "").lower()
+    log_format = os.environ.get("METRICS_SERVICE_LOG_FORMAT", "").lower()
+
+    if environment == "production" or log_format == "json":
+        log_cfg = copy.deepcopy(settings.get("LOGGING") or {})
+        log_cfg.setdefault("formatters", {})["json"] = {"()": "apps.core.logging_config.JsonFormatter"}
+        for h in log_cfg.get("handlers", {}).values():
+            if isinstance(h, dict) and "StreamHandler" in str(h.get("class", "")):
+                h["formatter"] = "json"
+        return {"LOGGING": log_cfg}
+    return {}