tdc114plus/docs/references/baron-safe-policies/runtime-config.md

Runtime Configuration

Baron Safe runtime values are injected at Flutter build/run time with --dart-define.

WebView URL

The app reads the initial WebView URL from BARON_SAFE_WEB_URL.

Environment	Example value	Purpose
local	http://10.0.2.2:8080	Android emulator access to a host preview server
staging	https://safe-staging.baron.hmac.kr	Internal QA and SSO integration testing
production	https://safe.baron.hmac.kr	Production Baron Safe web route

Default value in code:

https://safe.baron.hmac.kr

Run Examples

Android emulator local preview:

flutter run --dart-define=BARON_SAFE_WEB_URL=http://10.0.2.2:8080

Staging:

flutter run --dart-define=BARON_SAFE_WEB_URL=https://safe-staging.baron.hmac.kr

Release build example:

flutter build apk --dart-define=BARON_SAFE_WEB_URL=https://safe.baron.hmac.kr

Docker Flutter Examples

From repository root:

docker run --rm \
  -v /home/ubuntu/workspace/baron-safe-app/app:/app \
  -w /app \
  ghcr.io/cirruslabs/flutter:3.38.0 \
  flutter analyze

For build or run commands, pass the same --dart-define argument to Flutter inside the container.

Rules

• Do not hardcode staging-only or developer-only URLs in feature code.
• Do not put API keys, APNs keys, FCM server keys, signing keys, or production secrets in --dart-define.
• Keep WebView URL configuration separate from future native API base URL configuration.
• Keep the WebView allowed host list in app code small and explicit.
• Allow remote WebView traffic only over HTTPS.
• Allow HTTP only for local development hosts such as localhost, 127.0.0.1, and Android emulator host 10.0.2.2.

Verification

1. Confirm baron_safe_web_config.dart still reads BARON_SAFE_WEB_URL.
2. Confirm baron_safe_webview_policy.dart allows only approved WebView hosts.
3. Run flutter analyze.
4. Run WebView policy tests.
5. For device/emulator checks, launch the app with the environment-specific --dart-define and verify the /safe route loads the expected WebView target.