71 lines
2.2 KiB
Markdown
71 lines
2.2 KiB
Markdown
# Runtime Configuration
|
|
|
|
Baron Safe runtime values are injected at Flutter build/run time with `--dart-define`.
|
|
|
|
## WebView URL
|
|
|
|
The app reads the initial WebView URL from `BARON_SAFE_WEB_URL`.
|
|
|
|
| Environment | Example value | Purpose |
|
|
| --- | --- | --- |
|
|
| local | `http://10.0.2.2:8080` | Android emulator access to a host preview server |
|
|
| staging | `https://safe-staging.baron.hmac.kr` | Internal QA and SSO integration testing |
|
|
| production | `https://safe.baron.hmac.kr` | Production Baron Safe web route |
|
|
|
|
Default value in code:
|
|
|
|
```text
|
|
https://safe.baron.hmac.kr
|
|
```
|
|
|
|
## Run Examples
|
|
|
|
Android emulator local preview:
|
|
|
|
```bash
|
|
flutter run --dart-define=BARON_SAFE_WEB_URL=http://10.0.2.2:8080
|
|
```
|
|
|
|
Staging:
|
|
|
|
```bash
|
|
flutter run --dart-define=BARON_SAFE_WEB_URL=https://safe-staging.baron.hmac.kr
|
|
```
|
|
|
|
Release build example:
|
|
|
|
```bash
|
|
flutter build apk --dart-define=BARON_SAFE_WEB_URL=https://safe.baron.hmac.kr
|
|
```
|
|
|
|
## Docker Flutter Examples
|
|
|
|
From repository root:
|
|
|
|
```bash
|
|
docker run --rm \
|
|
-v /home/ubuntu/workspace/baron-safe-app/app:/app \
|
|
-w /app \
|
|
ghcr.io/cirruslabs/flutter:3.38.0 \
|
|
flutter analyze
|
|
```
|
|
|
|
For build or run commands, pass the same `--dart-define` argument to Flutter inside the container.
|
|
|
|
## Rules
|
|
|
|
- Do not hardcode staging-only or developer-only URLs in feature code.
|
|
- Do not put API keys, APNs keys, FCM server keys, signing keys, or production secrets in `--dart-define`.
|
|
- Keep WebView URL configuration separate from future native API base URL configuration.
|
|
- Keep the WebView allowed host list in app code small and explicit.
|
|
- Allow remote WebView traffic only over HTTPS.
|
|
- Allow HTTP only for local development hosts such as `localhost`, `127.0.0.1`, and Android emulator host `10.0.2.2`.
|
|
|
|
## Verification
|
|
|
|
1. Confirm [baron_safe_web_config.dart](../app/lib/src/features/webview/baron_safe_web_config.dart) still reads `BARON_SAFE_WEB_URL`.
|
|
2. Confirm [baron_safe_webview_policy.dart](../app/lib/src/features/webview/baron_safe_webview_policy.dart) allows only approved WebView hosts.
|
|
3. Run `flutter analyze`.
|
|
4. Run WebView policy tests.
|
|
5. For device/emulator checks, launch the app with the environment-specific `--dart-define` and verify the `/safe` route loads the expected WebView target.
|