refactor: added settings-driven DI and CSRF middleware with SSE subscribed event

.github/workflows/backend-ci.yml

@@ -47,6 +47,7 @@ jobs:
         run: |
           cd backend
           uv run pytest tests/unit -v -rs \
+            --durations=0 \
             --cov=app \
             --cov-report=xml --cov-report=term
 
@@ -116,6 +117,7 @@ jobs:
         run: |
           cd backend
           uv run pytest tests/integration -v -rs \
+            --durations=0 \
             --cov=app \
             --cov-report=xml --cov-report=term
 
@@ -210,6 +212,7 @@ jobs:
         run: |
           cd backend
           uv run pytest tests/e2e -v -rs \
+            --durations=0 \
             --cov=app \
             --cov-report=xml --cov-report=term
 

backend/.env

@@ -76,3 +76,6 @@ WEB_BACKLOG=2048
 # When running uvicorn locally (outside Docker), bind to IPv4 loopback to avoid
 # IPv6-only localhost resolution on some Linux distros.
 SERVER_HOST=127.0.0.1
+
+# Security
+BCRYPT_ROUNDS=12

backend/.env.test

@@ -3,7 +3,6 @@ PROJECT_NAME=integr8scode
 DATABASE_NAME=integr8scode_test
 API_V1_STR=/api/v1
 SECRET_KEY=test-secret-key-for-testing-only-32chars!!
-ENVIRONMENT=testing
 TESTING=true
 
 # MongoDB - use localhost for tests
@@ -27,18 +26,16 @@ SCHEMA_REGISTRY_URL=http://localhost:8081
 
 # Security
 SECURE_COOKIES=true
-CORS_ALLOWED_ORIGINS=["http://localhost:3000","https://localhost:3000"]
+BCRYPT_ROUNDS=4
 
 # Features
 RATE_LIMIT_ENABLED=true
 ENABLE_TRACING=false
 
-# OpenTelemetry - explicitly disabled for tests (no endpoint = NoOp meter)
+# OpenTelemetry - explicitly disabled for tests
 OTEL_EXPORTER_OTLP_ENDPOINT=
-OTEL_METRICS_EXPORTER=none
-OTEL_TRACES_EXPORTER=none
-OTEL_LOGS_EXPORTER=none
 
 # Development
 DEVELOPMENT_MODE=false
 LOG_LEVEL=INFO
+ENVIRONMENT=test

backend/Dockerfile

@@ -27,7 +27,8 @@ done
 echo "Starting application..."
 [ -f /app/kubeconfig.yaml ] && export KUBECONFIG=/app/kubeconfig.yaml
 
-exec gunicorn app.main:app \
+exec gunicorn 'app.main:create_app' \
+  --factory \
   -k uvicorn.workers.UvicornWorker \
   --bind 0.0.0.0:443 \
   --workers ${WEB_CONCURRENCY:-4} \

backend/app/api/routes/auth.py

@@ -7,7 +7,7 @@
 from fastapi.security import OAuth2PasswordRequestForm
 from pymongo.errors import DuplicateKeyError
 
-from app.core.security import security_service
+from app.core.security import SecurityService
 from app.core.utils import get_client_ip
 from app.db.repositories import UserRepository
 from app.domain.user import DomainUserCreate
@@ -19,7 +19,7 @@
     UserResponse,
 )
 from app.services.auth_service import AuthService
-from app.settings import get_settings
+from app.settings import Settings
 
 router = APIRouter(prefix="/auth", tags=["authentication"], route_class=DishkaRoute)
 
@@ -29,6 +29,8 @@ async def login(
     request: Request,
     response: Response,
     user_repo: FromDishka[UserRepository],
+    security_service: FromDishka[SecurityService],
+    settings: FromDishka[Settings],
     logger: FromDishka[logging.Logger],
     form_data: OAuth2PasswordRequestForm = Depends(),
 ) -> LoginResponse:
@@ -74,8 +76,6 @@ async def login(
             headers={"WWW-Authenticate": "Bearer"},
         )
 
-    settings = get_settings()
-
     logger.info(
         "Login successful",
         extra={
@@ -127,6 +127,7 @@ async def register(
     request: Request,
     user: UserCreate,
     user_repo: FromDishka[UserRepository],
+    security_service: FromDishka[SecurityService],
     logger: FromDishka[logging.Logger],
 ) -> UserResponse:
     logger.info(

backend/app/api/routes/events.py

@@ -27,7 +27,7 @@
 from app.schemas_pydantic.user import UserResponse
 from app.services.event_service import EventService
 from app.services.kafka_event_service import KafkaEventService
-from app.settings import get_settings
+from app.settings import Settings
 
 router = APIRouter(prefix="/events", tags=["events"], route_class=DishkaRoute)
 
@@ -229,8 +229,8 @@ async def publish_custom_event(
     event_request: PublishEventRequest,
     request: Request,
     event_service: FromDishka[KafkaEventService],
+    settings: FromDishka[Settings],
 ) -> PublishEventResponse:
-    settings = get_settings()
     base_meta = EventMetadata(
         service_name=settings.SERVICE_NAME,
         service_version=settings.SERVICE_VERSION,
@@ -311,6 +311,7 @@ async def replay_aggregate_events(
     admin: Annotated[UserResponse, Depends(admin_user)],
     event_service: FromDishka[EventService],
     kafka_event_service: FromDishka[KafkaEventService],
+    settings: FromDishka[Settings],
     logger: FromDishka[logging.Logger],
     target_service: str | None = Query(None, description="Service to replay events to"),
     dry_run: bool = Query(True, description="If true, only show what would be replayed"),
@@ -339,7 +340,6 @@ async def replay_aggregate_events(
             await asyncio.sleep(0.1)
 
         try:
-            settings = get_settings()
             meta = EventMetadata(
                 service_name=settings.SERVICE_NAME,
                 service_version=settings.SERVICE_VERSION,

backend/app/api/routes/execution.py

@@ -34,7 +34,7 @@
 from app.services.execution_service import ExecutionService
 from app.services.idempotency import IdempotencyManager
 from app.services.kafka_event_service import KafkaEventService
-from app.settings import get_settings
+from app.settings import Settings
 
 router = APIRouter(route_class=DishkaRoute)
 
@@ -162,6 +162,7 @@ async def cancel_execution(
     current_user: Annotated[UserResponse, Depends(current_user)],
     cancel_request: CancelExecutionRequest,
     event_service: FromDishka[KafkaEventService],
+    settings: FromDishka[Settings],
 ) -> CancelResponse:
     # Handle terminal states
     terminal_states = [ExecutionStatus.COMPLETED, ExecutionStatus.FAILED, ExecutionStatus.TIMEOUT]
@@ -178,7 +179,6 @@ async def cancel_execution(
             event_id="-1",  # exact event_id unknown
         )
 
-    settings = get_settings()
     payload = {
         "execution_id": execution.execution_id,
         "status": str(ExecutionStatus.CANCELLED),

backend/app/core/adaptive_sampling.py

@@ -2,14 +2,14 @@
 import threading
 import time
 from collections import deque
-from typing import Any, Sequence, Tuple
+from typing import Sequence, Tuple
 
 from opentelemetry.context import Context
 from opentelemetry.sdk.trace.sampling import Decision, Sampler, SamplingResult
 from opentelemetry.trace import Link, SpanKind, TraceState, get_current_span
 from opentelemetry.util.types import Attributes
 
-from app.settings import get_settings
+from app.settings import Settings
 
 
 class AdaptiveSampler(Sampler):
@@ -239,11 +239,8 @@ def shutdown(self) -> None:
             self._adjustment_thread.join(timeout=5.0)
 
 
-def create_adaptive_sampler(settings: Any | None = None) -> AdaptiveSampler:
+def create_adaptive_sampler(settings: Settings) -> AdaptiveSampler:
     """Create adaptive sampler with settings"""
-    if settings is None:
-        settings = get_settings()
-
     return AdaptiveSampler(
         base_rate=settings.TRACING_SAMPLING_RATE,
         min_rate=max(0.001, settings.TRACING_SAMPLING_RATE / 100),  # 1/100th of base

backend/app/core/container.py

@@ -45,6 +45,7 @@ def create_app_container(settings: Settings) -> AsyncContainer:
         RepositoryProvider(),
         MessagingProvider(),
         EventProvider(),
+        SagaOrchestratorProvider(),
         KafkaServicesProvider(),
         SSEProvider(),
         AuthProvider(),

backend/app/core/dishka_lifespan.py

@@ -44,25 +44,32 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
     # Metrics setup moved to app creation to allow middleware registration
     logger.info("Lifespan start: tracing and services initialization")
 
-    # Initialize tracing
-    instrumentation_report = init_tracing(
-        service_name=settings.TRACING_SERVICE_NAME,
-        logger=logger,
-        service_version=settings.TRACING_SERVICE_VERSION,
-        sampling_rate=settings.TRACING_SAMPLING_RATE,
-        enable_console_exporter=settings.TESTING,
-        adaptive_sampling=settings.TRACING_ADAPTIVE_SAMPLING,
-    )
-
-    if instrumentation_report.has_failures():
-        logger.warning(
-            "Some instrumentation libraries failed to initialize",
-            extra={"instrumentation_summary": instrumentation_report.get_summary()},
+    # Initialize tracing only when enabled (avoid exporter retries in tests)
+    if settings.ENABLE_TRACING and not settings.TESTING:
+        instrumentation_report = init_tracing(
+            service_name=settings.TRACING_SERVICE_NAME,
+            settings=settings,
+            logger=logger,
+            service_version=settings.TRACING_SERVICE_VERSION,
+            sampling_rate=settings.TRACING_SAMPLING_RATE,
+            enable_console_exporter=settings.TESTING,
+            adaptive_sampling=settings.TRACING_ADAPTIVE_SAMPLING,
         )
+
+        if instrumentation_report.has_failures():
+            logger.warning(
+                "Some instrumentation libraries failed to initialize",
+                extra={"instrumentation_summary": instrumentation_report.get_summary()},
+            )
+        else:
+            logger.info(
+                "Distributed tracing initialized successfully",
+                extra={"instrumentation_summary": instrumentation_report.get_summary()},
+            )
     else:
         logger.info(
-            "Distributed tracing initialized successfully",
-            extra={"instrumentation_summary": instrumentation_report.get_summary()},
+            "Distributed tracing disabled",
+            extra={"testing": settings.TESTING, "enable_tracing": settings.ENABLE_TRACING},
         )
 
     # Initialize schema registry once at startup

backend/app/core/metrics/base.py

@@ -1,57 +1,54 @@
 from dataclasses import dataclass
-from typing import Optional
 
 from opentelemetry.exporter.otlp.proto.grpc.metric_exporter import OTLPMetricExporter
 from opentelemetry.metrics import Meter, NoOpMeterProvider
 from opentelemetry.sdk.metrics import MeterProvider as SdkMeterProvider
 from opentelemetry.sdk.metrics.export import PeriodicExportingMetricReader
 from opentelemetry.sdk.resources import Resource
 
-from app.settings import get_settings
+from app.settings import Settings
 
 
 @dataclass
 class MetricsConfig:
     service_name: str = "integr8scode-backend"
     service_version: str = "1.0.0"
-    otlp_endpoint: Optional[str] = None
+    otlp_endpoint: str | None = None
     export_interval_millis: int = 10000
     console_export_interval_millis: int = 60000
 
 
 class BaseMetrics:
-    def __init__(self, meter_name: str | None = None):
+    def __init__(self, settings: Settings, meter_name: str | None = None):
         """Initialize base metrics with its own meter.
 
         Args:
+            settings: Application settings.
             meter_name: Optional name for the meter. Defaults to class name.
         """
-        # Get settings and create config
-        settings = get_settings()
         config = MetricsConfig(
             service_name=settings.TRACING_SERVICE_NAME or "integr8scode-backend",
             service_version="1.0.0",
             otlp_endpoint=settings.OTEL_EXPORTER_OTLP_ENDPOINT,
         )
 
-        # Each collector creates its own independent meter
         meter_name = meter_name or self.__class__.__name__
-        self._meter = self._create_meter(config, meter_name)
+        self._meter = self._create_meter(settings, config, meter_name)
         self._create_instruments()
 
-    def _create_meter(self, config: MetricsConfig, meter_name: str) -> Meter:
+    def _create_meter(self, settings: Settings, config: MetricsConfig, meter_name: str) -> Meter:
         """Create a new meter instance for this collector.
 
         Args:
+            settings: Application settings
             config: Metrics configuration
             meter_name: Name for this meter
 
         Returns:
             A new meter instance
         """
-        # If tracing/metrics disabled or no OTLP endpoint configured, use NoOp meter to avoid threads/network
-        settings = get_settings()
-        if not settings.ENABLE_TRACING or not config.otlp_endpoint:
+        # If tracing/metrics disabled or no OTLP endpoint configured, use NoOp meter
+        if not config.otlp_endpoint:
             return NoOpMeterProvider().get_meter(meter_name)
 
         resource = Resource.create(

backend/app/core/metrics/context.py

@@ -45,21 +45,20 @@ def __init__(self, name: str, metric_class: Type[T], logger: logging.Logger) ->
 
     def get(self) -> T:
         """
-        Get the metric from context, creating it if necessary.
-
-        This method implements lazy initialization - if no metric exists
-        in the current context, it creates one. This is useful for testing
-        and standalone scripts where the context might not be initialized.
+        Get the metric from context.
 
         Returns:
             The metric instance for the current context
+
+        Raises:
+            RuntimeError: If metrics not initialized via DI
         """
         metric = self._context_var.get()
         if metric is None:
-            # Lazy initialization with logging
-            self.logger.debug(f"Lazy initializing {self._name} metrics in context")
-            metric = self._metric_class()
-            self._context_var.set(metric)
+            raise RuntimeError(
+                f"{self._name} metrics not initialized. "
+                "Ensure MetricsContext.initialize_all() is called during app startup."
+            )
         return metric
 
     def set(self, metric: T) -> contextvars.Token[Optional[T]]: