feat: add manual production deployment pipeline

scripts/production-settings.mjs

@@ -0,0 +1,55 @@
+import { orgContextConfig } from '../src/org-context.js';
+import { deploymentOrgSettings } from './org-context-settings.mjs';
+
+export const productionTarget = Object.freeze({
+  worker: 'baron-qa-gateway-prod',
+  config: 'wrangler.production.toml',
+  bucket: 'baron-qa-write',
+  origin: 'https://qa.baroncs.co.kr'
+});
+
+function required(env, name) {
+  const value = String(env[name] || '').trim();
+  if (!value) throw new Error(name + ' is required for production');
+  return value;
+}
+
+function httpsBase(value, name) {
+  let url;
+  try { url = new URL(value); } catch { throw new Error(name + ' must be an HTTPS origin'); }
+  if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash || url.pathname !== '/') {
+    throw new Error(name + ' must be an HTTPS origin');
+  }
+  return url.origin;
+}
+
+export function productionSettings(env) {
+  // These names are mapped exclusively from PROD_* settings in the production workflow.
+  required(env, 'CLOUDFLARE_API_TOKEN');
+  const secrets = {
+    SESSION_SECRET: required(env, 'SESSION_SECRET'),
+    ABC_API_KEY: required(env, 'ABC_API_KEY'),
+    ORG_CONTEXT_KEY_ID: required(env, 'ORG_CONTEXT_KEY_ID'),
+    ORG_CONTEXT_KEY_SECRET: required(env, 'ORG_CONTEXT_KEY_SECRET')
+  };
+  if (secrets.SESSION_SECRET.length < 32) throw new Error('SESSION_SECRET must contain at least 32 characters');
+  if (required(env, 'ORG_CONTEXT_ENABLED') !== 'true') throw new Error('ORG_CONTEXT_ENABLED must be true for production');
+  const organization = deploymentOrgSettings(env);
+  orgContextConfig({ ...organization.vars, ...secrets });
+
+  const vars = {
+    ...organization.vars,
+    AUTH_CLIENT_ID: required(env, 'AUTH_CLIENT_ID'),
+    ABC_API_BASE_URL: httpsBase(required(env, 'ABC_API_BASE_URL'), 'ABC_API_BASE_URL'),
+    ABC_PROJECT_ID: required(env, 'ABC_PROJECT_ID'),
+    ABC_CHANNEL_ID: required(env, 'ABC_CHANNEL_ID')
+  };
+  const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  for (const name of ['ABC_PROJECT_ID', 'ABC_CHANNEL_ID']) {
+    if (!uuid.test(vars[name])) throw new Error(name + ' must be a UUID');
+  }
+  const revision = required(env, 'DEPLOY_COMMIT_SHA');
+  if (!/^[0-9a-f]{40}$/.test(revision)) throw new Error('DEPLOY_COMMIT_SHA must be a full lowercase Git commit SHA');
+  vars.QA_ASSET_PREFIX = 'releases/' + revision;
+  return { ...productionTarget, vars, secrets };
+}