[AAP-69236] Enable startup validation for production environment variables (#193)

* Enable startup validation for production environment variables

* Formatting fix

* Updated tests

* Uncomment SEGMENT_WRITE_KEY fix:

SEGMENT_WRITE_KEY is baked into container image at build time, so it should always be present even in air-gapped environments. Validator ensures proper configuration at startup

* Add comprehensive test coverage for production validator enforcement

* Refactor validator tests

* Add module-level import test for production validator coverage

* update sonar properties

* Removed brittle tests after updating sonarcloud configuration

Author: pmflanagan

apps/settings/production.py

@@ -75,33 +75,38 @@
     ),
 )
 
-# Optional until gateway APIs are implemented; uncomment validator when re-adding.
 RESOURCE_SERVER__SECRET_KEY = ""
-# validators.append(
-#     Validator(
-#         "RESOURCE_SERVER__SECRET_KEY",
-#         must_exist=True,
-#         ne="",
-#         messages={"operations": "RESOURCE_SERVER__SECRET_KEY must be set."},
-#     ),
-# )
+validators.append(
+    Validator(
+        "RESOURCE_SERVER__SECRET_KEY",
+        must_exist=True,
+        ne="",
+        messages={
+            "operations": (
+                "RESOURCE_SERVER__SECRET_KEY must be set. "
+                "Set METRICS_SERVICE_RESOURCE_SERVER__SECRET_KEY environment variable."
+            )
+        },
+    ),
+)
 
 # =============================================================================
 # Authentication
 # =============================================================================
 
-# Optional until gateway APIs are implemented; uncomment validator when re-adding.
 ANSIBLE_BASE_JWT_KEY = ""
-# validators.append(
-#     Validator(
-#         "ANSIBLE_BASE_JWT_KEY",
-#         must_exist=True,
-#         ne="",
-#         messages={
-#             "operations": ("ANSIBLE_BASE_JWT_KEY must be set. "),
-#         },
-#     ),
-# )
+validators.append(
+    Validator(
+        "ANSIBLE_BASE_JWT_KEY",
+        must_exist=True,
+        ne="",
+        messages={
+            "operations": (
+                "ANSIBLE_BASE_JWT_KEY must be set. Set METRICS_SERVICE_ANSIBLE_BASE_JWT_KEY environment variable."
+            )
+        },
+    ),
+)
 
 REST_FRAMEWORK__DEFAULT_AUTHENTICATION_CLASSES = [
     "apps.core.authentication.ServiceJWTAuthentication",
@@ -202,16 +207,26 @@
 # External Services
 # =============================================================================
 
-# Optional until gateway APIs are implemented; uncomment validator when re-adding.
+# Loaded from file at startup via _load_segment_write_key_from_file().
+# Default path: /etc/ansible-automation-platform/metrics/segment-write-key
+# Override path via METRICS_SERVICE_SEGMENT_WRITE_KEY_FILE
+# Key is baked into container image at build time - always present even in air-gapped environments.
 SEGMENT_WRITE_KEY = ""
-# validators.append(
-#     Validator(
-#         "SEGMENT_WRITE_KEY",
-#         must_exist=True,
-#         ne="",
-#         messages={"operations": "SEGMENT_WRITE_KEY must be set."},
-#     ),
-# )
+validators.append(
+    Validator(
+        "SEGMENT_WRITE_KEY",
+        must_exist=True,
+        ne="",
+        messages={
+            "operations": (
+                "SEGMENT_WRITE_KEY must be set. "
+                "Either set METRICS_SERVICE_SEGMENT_WRITE_KEY environment variable "
+                "or provide the key file at /etc/ansible-automation-platform/metrics/segment-write-key "
+                "(or path specified in METRICS_SERVICE_SEGMENT_WRITE_KEY_FILE)."
+            )
+        },
+    ),
+)
 
 # =============================================================================
 # Static Files
@@ -232,16 +247,21 @@
 # =============================================================================
 # Allowed Hosts
 # =============================================================================
-# Optional until gateway APIs are implemented; uncomment validator when re-adding.
 # Set via METRICS_SERVICE_ALLOWED_HOSTS (comma-separated or JSON array).
 # Example: METRICS_SERVICE_ALLOWED_HOSTS=metrics.example.com,api.example.com
 # Or:      METRICS_SERVICE_ALLOWED_HOSTS='["metrics.example.com","api.example.com"]'
 ALLOWED_HOSTS = []
-# validators.append(
-#     Validator(
-#         "ALLOWED_HOSTS",
-#         must_exist=True,
-#         condition=lambda v: isinstance(v, list) and len(v) > 0,
-#         messages={"condition": "ALLOWED_HOSTS must be set via METRICS_SERVICE_ALLOWED_HOSTS in production."},
-#     ),
-# )
+validators.append(
+    Validator(
+        "ALLOWED_HOSTS",
+        must_exist=True,
+        condition=lambda v: isinstance(v, list) and len(v) > 0,
+        messages={
+            "condition": (
+                "ALLOWED_HOSTS must be set via METRICS_SERVICE_ALLOWED_HOSTS in production. "
+                "Django will reject all requests with an empty ALLOWED_HOSTS list. "
+                "Set METRICS_SERVICE_ALLOWED_HOSTS to a comma-separated list or JSON array of hostnames."
+            )
+        },
+    ),
+)

metrics_service/settings.py

@@ -469,6 +469,6 @@ def _load_segment_write_key_from_file(
 DYNACONF.set("DATABASES", _databases)
 
 # Update django.conf.settings with DYNACONF keys.
-export(__name__, DYNACONF, validation=False)
+export(__name__, DYNACONF, validation=True)
 
 ## --- End Settings | After this line only post validation can happen --- #

sonar-project.properties

@@ -12,7 +12,7 @@ sonar.organization=ansible
 
 # Customize what paths to scan. Default is .
 sonar.sources=.
-sonar.exclusions=**/tests/**,**/migrations/**,**/tools/**,.venv/**,scripts/**,htmlcov/**
+sonar.exclusions=**/tests/**,**/migrations/**,**/tools/**,.venv/**,scripts/**,htmlcov/**,**/settings/**
 
 # Verbose name of project displayed in WUI. Default is set to the projectKey. This field is optional.
 sonar.projectName=metrics-service
@@ -23,7 +23,7 @@ sonar.projectName=metrics-service
 # Tell sonar scanner where coverage files exist
 sonar.python.coverage.reportPaths=coverage.xml
 # Exclude certain directories from code coverage reporting
-sonar.coverage.exclusions=**/tests/**,**/tools**,**/migrations/**
+sonar.coverage.exclusions=**/tests/**,**/tools**,**/migrations/**,**/settings/**
 # Manages code duplication sensitivity.  Default is 100.  Higher number means less sensitive.
 sonar.cpd.python.minimumTokens=150
 sonar.cpd.python.minimumLines=300

tests/unit/test_dynaconf_settings.py

@@ -87,27 +87,33 @@ def test_database_validators_configured(self):
         db_validators = [v for v in validators if any("DATABASES" in str(name) for name in v.names)]
         assert len(db_validators) > 0
 
-    def test_optional_production_settings_have_no_validators(self):
-        """Test that optional production settings are not required by validators.
+    def test_required_production_settings_have_validators(self):
+        """Test that required production settings have validators.
 
         RESOURCE_SERVER__SECRET_KEY, ANSIBLE_BASE_JWT_KEY, SEGMENT_WRITE_KEY, and
-        ALLOWED_HOSTS are optional in production so deployments can start without
-        gateway auth, Segment, or explicit allowed hosts when not needed.
+        ALLOWED_HOSTS are now required in production to ensure proper AAP gateway
+        integration and prevent misconfigured deployments.
+
+        SEGMENT_WRITE_KEY is baked into the container image at build time, so it
+        should always be present even in air-gapped environments.
         """
         from apps.settings.production import validators
 
-        optional_settings = {
+        required_settings = {
             "RESOURCE_SERVER__SECRET_KEY",
             "ANSIBLE_BASE_JWT_KEY",
             "SEGMENT_WRITE_KEY",
             "ALLOWED_HOSTS",
         }
+
+        found_validators = set()
         for v in validators:
             for name in v.names:
-                assert name not in optional_settings, (
-                    f"Setting {name!r} should be optional (no validator); "
-                    "remove its validator from apps/settings/production.py"
-                )
+                if name in required_settings:
+                    found_validators.add(name)
+
+        # All required settings should have validators
+        assert found_validators == required_settings, f"Missing validators for: {required_settings - found_validators}"
 
     def test_settings_pass_validation(self):
         """Test that current settings pass validation (since we're running)."""