feat(backend): add FastAPI backend — procurement, inventory domain, Casdoor auth, PM arrival endpoints

backend/app/config.py

@@ -0,0 +1,56 @@
+"""Application configuration.
+
+All settings can be overridden with environment variables prefixed with
+``PROCUREMENT_`` (e.g. ``PROCUREMENT_DATABASE_URL=...``) or a local ``.env`` file.
+"""
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+class Settings(BaseSettings):
+    model_config = SettingsConfigDict(
+        env_prefix="PROCUREMENT_",
+        env_file=".env",
+        env_file_encoding="utf-8",
+        extra="ignore",
+    )
+
+    # PostgreSQL DSN — the schema (migration.sql + seed.sql) must already exist.
+    DATABASE_URL: str = "postgresql+asyncpg://postgres:postgres@localhost:5432/procurement"
+
+    # Echo SQL statements to the console (dev aid).
+    DEBUG_SQL: bool = False
+
+    # MinIO object storage — invoice / proforma attachments (S3-compatible).
+    # Endpoint is the compose service name (`minio:9000`) inside Docker.
+    MINIO_ENDPOINT: str = "localhost:9000"
+    MINIO_ACCESS_KEY: str = "minioadmin"
+    MINIO_SECRET_KEY: str = "minioadmin"
+    MINIO_BUCKET: str = "procurement-files"
+    MINIO_SECURE: bool = False
+
+    # Background auto-expiry of offered quotes whose expiry_date has passed.
+    AUTO_EXPIRE_ENABLED: bool = True
+    AUTO_EXPIRE_INTERVAL_SECONDS: int = 3600
+
+    # Pagination limits (contract: default 20, max 100).
+    DEFAULT_PAGE_SIZE: int = 20
+    MAX_PAGE_SIZE: int = 100
+
+    # CORS (dev-friendly default; the frontend is a static site).
+    CORS_ORIGINS: list[str] = ["*"]
+
+    # Casdoor (OIDC) — JWT verification against the issuer's JWKS.
+    CASDOOR_ENDPOINT: str = "http://localhost:8080"
+    CASDOOR_CLIENT_ID: str = "inventory-app-client"
+    CASDOOR_CLIENT_SECRET: str = "inventory-app-secret-2026"
+    CASDOOR_ORGANIZATION: str = "inventory"
+    CASDOOR_APP_NAME: str = "inventory-app"
+    CASDOOR_JWKS_URL: str = ""  # default: {endpoint}/api/public_jwks
+    CASDOOR_AUDIENCE: str = "inventory-app-client"  # expected token aud (falls back to client_id)
+
+    # Inventory dev fallback (only when no Authorization header is sent).
+    INVENTORY_DEFAULT_ROLE: str = "pm"
+    INVENTORY_DEFAULT_PROJECT_ID: str = ""
+
+
+settings = Settings()