Add Baron Safe app features through session block skeleton

2026-06-30 17:17:14 +09:00
parent d2f6af7657
commit 7c8e95e0a3
23 changed files with 1531 additions and 5 deletions
@@ -0,0 +1,70 @@
+# Runtime Configuration
+
+Baron Safe runtime values are injected at Flutter build/run time with `--dart-define`.
+
+## WebView URL
+
+The app reads the initial WebView URL from `BARON_SAFE_WEB_URL`.
+
+| Environment | Example value | Purpose |
+| --- | --- | --- |
+| local | `http://10.0.2.2:8080` | Android emulator access to a host preview server |
+| staging | `https://safe-staging.baron.hmac.kr` | Internal QA and SSO integration testing |
+| production | `https://safe.baron.hmac.kr` | Production Baron Safe web route |
+
+Default value in code:
+
+```text
+https://safe.baron.hmac.kr
+```
+
+## Run Examples
+
+Android emulator local preview:
+
+```bash
+flutter run --dart-define=BARON_SAFE_WEB_URL=http://10.0.2.2:8080
+```
+
+Staging:
+
+```bash
+flutter run --dart-define=BARON_SAFE_WEB_URL=https://safe-staging.baron.hmac.kr
+```
+
+Release build example:
+
+```bash
+flutter build apk --dart-define=BARON_SAFE_WEB_URL=https://safe.baron.hmac.kr
+```
+
+## Docker Flutter Examples
+
+From repository root:
+
+```bash
+docker run --rm \
+  -v /home/ubuntu/workspace/baron-safe-app/app:/app \
+  -w /app \
+  ghcr.io/cirruslabs/flutter:3.38.0 \
+  flutter analyze
+```
+
+For build or run commands, pass the same `--dart-define` argument to Flutter inside the container.
+
+## Rules
+
+- Do not hardcode staging-only or developer-only URLs in feature code.
+- Do not put API keys, APNs keys, FCM server keys, signing keys, or production secrets in `--dart-define`.
+- Keep WebView URL configuration separate from future native API base URL configuration.
+- Keep the WebView allowed host list in app code small and explicit.
+- Allow remote WebView traffic only over HTTPS.
+- Allow HTTP only for local development hosts such as `localhost`, `127.0.0.1`, and Android emulator host `10.0.2.2`.
+
+## Verification
+
+1. Confirm [baron_safe_web_config.dart](../app/lib/src/features/webview/baron_safe_web_config.dart) still reads `BARON_SAFE_WEB_URL`.
+2. Confirm [baron_safe_webview_policy.dart](../app/lib/src/features/webview/baron_safe_webview_policy.dart) allows only approved WebView hosts.
+3. Run `flutter analyze`.
+4. Run WebView policy tests.
+5. For device/emulator checks, launch the app with the environment-specific `--dart-define` and verify the `/safe` route loads the expected WebView target.