fix(config): refuse to start with the development auth secret, and add CI

[VampiricCyborg]

Two unrelated fixes that pair usefully: CI's very first run is against the commit that makes CI need AUTH_SECRET, so the first PR this workflow gates is also the one that validates it end to end.

1. The auth secret guard

auth_secret is the only input to the session cookie's HMAC, and it fell back to "dev-only-change-me" — a constant committed to this public repository. Any deployment that never set AUTH_SECRET was signing sessions with a key anyone could read, which is enough to mint a cookie for any user id and read that user's documents. AUTH_SECRET was also missing from .env.example, so nothing ever prompted anyone to set it.

A @model_validator(mode="after") on Settings now rejects an empty or still-default secret whenever debug is off. It fires at Settings() construction — which app/main.py performs at import — so a misconfigured process dies before create_app() wires a single route. Debug builds stay exempt, so local development needs no setup.

Verified both paths:

DEBUG=false AUTH_SECRET=ci-only-secret  ->  app imported OK
DEBUG=false (no AUTH_SECRET)            ->  ValidationError: AUTH_SECRET is unset or still
                                            the development default...

Five new cases in tests/test_security.py cover the default, empty and whitespace secrets, a real secret, and debug builds staying exempt.

Important

Railway production does not currently have AUTH_SECRET set (confirmed against the Railway API, not railway.json), and it deploys from main. Set the variable in Railway before merging this PR. Merging first means the guard does exactly what it is built to do and takes the backend down on deploy.

Whatever value is set invalidates every session cookie currently outstanding, so everyone signed in is logged out once. That is the intended outcome given the old key was public — but it is worth a heads-up rather than a surprise.

2. CI

Two jobs, neither needing a live service: pytest -q for the backend, and tsc --noEmit / npm run lint / npm run build for the frontend. The backend suite mocks the database and the embedding service, and the tests use ASGITransport, so the app's lifespan never loads the ONNX model.

The backend job sets a throwaway AUTH_SECRET because of the guard above.

npm run lint was already failing on react-hooks/set-state-in-effect in useDemoLoop.ts, so CI would have been red on its first run. useTypewriter now rewinds during render instead of in an effect, which also removes a frame where a changed line rendered at the previous line's length.

Checks run locally

• pytest -q — 84 passed (was 79)
• npx tsc --noEmit — clean
• npx eslint . — 0 errors (1 warning in services/mock.ts, which is being deleted separately)
• npm run build — 15 routes

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docu-query	Ready	Preview	Sep 20, 2026 7:59am UTC