# Runtime Configuration

Baron Safe runtime values are injected at Flutter build/run time with `--dart-define`.

## WebView URL

The app reads the initial WebView URL from `BARON_SAFE_WEB_URL`.

| Environment | Example value | Purpose |
| --- | --- | --- |
| local | `http://10.0.2.2:8080` | Android emulator access to a host preview server |
| staging | `https://safe-staging.baron.hmac.kr` | Internal QA and SSO integration testing |
| production | `https://safe.baron.hmac.kr` | Production Baron Safe web route |

Default value in code:

```text
https://safe.baron.hmac.kr
```

## Run Examples

Android emulator local preview:

```bash
flutter run --dart-define=BARON_SAFE_WEB_URL=http://10.0.2.2:8080
```

Staging:

```bash
flutter run --dart-define=BARON_SAFE_WEB_URL=https://safe-staging.baron.hmac.kr
```

Release build example:

```bash
flutter build apk --dart-define=BARON_SAFE_WEB_URL=https://safe.baron.hmac.kr
```

## Docker Flutter Examples

From repository root:

```bash
docker run --rm \
  -v /home/ubuntu/workspace/baron-safe-app/app:/app \
  -w /app \
  ghcr.io/cirruslabs/flutter:3.38.0 \
  flutter analyze
```

For build or run commands, pass the same `--dart-define` argument to Flutter inside the container.

## Rules

- Do not hardcode staging-only or developer-only URLs in feature code.
- Do not put API keys, APNs keys, FCM server keys, signing keys, or production secrets in `--dart-define`.
- Keep WebView URL configuration separate from future native API base URL configuration.
- Keep the WebView allowed host list in app code small and explicit.
- Allow remote WebView traffic only over HTTPS.
- Allow HTTP only for local development hosts such as `localhost`, `127.0.0.1`, and Android emulator host `10.0.2.2`.

## Verification

1. Confirm [baron_safe_web_config.dart](../app/lib/src/features/webview/baron_safe_web_config.dart) still reads `BARON_SAFE_WEB_URL`.
2. Confirm [baron_safe_webview_policy.dart](../app/lib/src/features/webview/baron_safe_webview_policy.dart) allows only approved WebView hosts.
3. Run `flutter analyze`.
4. Run WebView policy tests.
5. For device/emulator checks, launch the app with the environment-specific `--dart-define` and verify the `/safe` route loads the expected WebView target.