US08-01: Make the Trust Boundary Configurable and Authenticated

photo_pipeline/config.py

@@ -7,6 +7,9 @@ real external call needs them.
 
 pydantic-settings would do this too, but a prefix-scan over the declared fields
 is a few lines and one fewer dependency.
+
+Tuple-valued settings are lists in one variable: library roots are ``os.pathsep``
+separated because they are paths, everything else is comma separated.
 """
 
 from __future__ import annotations
@@ -20,6 +23,7 @@ from pydantic import BaseModel, ConfigDict, SecretStr
 ENV_PREFIX = "PHOTO_PIPELINE_"
 ENV_FILE_VAR = f"{ENV_PREFIX}ENV_FILE"
 DEFAULT_ENV_FILE = Path(".env")
+COMMA_LIST_FIELDS = frozenset({"allowed_hosts", "trusted_proxies"})
 
 # The archived CLI's variable names, so the configuration file an operator already
 # has keeps working. The vision provider reads the OpenAI SDK's names, and the
@@ -85,6 +89,19 @@ class Config(BaseModel):
     log_level: str = "INFO"
     log_format: str = "json"  # "json" or "text"
 
+    # Trust boundary (US08-01). Empty means loopback only, which is what the app did
+    # before there was a setting: a request whose Host is not a loopback name is
+    # refused, and no secret is needed because nothing outside this machine can call.
+    # Naming a real hostname here is what makes the app reachable through a reverse
+    # proxy, and it is exactly then that ``access_secret`` becomes mandatory.
+    allowed_hosts: tuple[str, ...] = ()
+    # Addresses whose ``X-Forwarded-Proto``/``X-Forwarded-Host`` may be believed. A
+    # client that is not the proxy can otherwise declare its own origin.
+    trusted_proxies: tuple[str, ...] = ()
+    # Exchanged for the session cookie at the bootstrap endpoint. Once set it is
+    # required even on loopback, so a development setup cannot half-enable it.
+    access_secret: SecretStr | None = None
+
     # Largest request body the API accepts. Every endpoint takes small JSON commands;
     # anything larger is a mistake or an attempt to exhaust memory (US07-02).
     max_request_bytes: int = 1_048_576
@@ -131,5 +148,10 @@ class Config(BaseModel):
             raw = env.get(ENV_PREFIX + name.upper())
             if not raw:
                 continue
-            data[name] = raw.split(os.pathsep) if name == "library_roots" else raw
+            if name == "library_roots":
+                data[name] = raw.split(os.pathsep)
+            elif name in COMMA_LIST_FIELDS:
+                data[name] = [part.strip() for part in raw.split(",") if part.strip()]
+            else:
+                data[name] = raw
         return cls(**data)