rebase

CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to AI-RPG are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.3] — 2026-06-20
+
+### Fixed
+- **app/config.py**: fixed `SettingsError: error parsing value for field "cors_origins" from source "EnvSettingsSource"` that crashed the backend on startup when `CORS_ORIGINS` was set as a comma-separated string (e.g. `http://localhost:8080,http://localhost:5173,http://localhost`).
+  - Root cause: pydantic-settings v2 by default tries to JSON-parse complex-typed env vars before applying field validators. The comma-separated string isn't valid JSON, so parsing failed before our `@field_validator(mode="before")` could split it.
+  - Fix: declared `cors_origins: Annotated[list[str], NoDecode]` — `NoDecode` is a pydantic-settings marker that disables JSON pre-parsing, so the raw string reaches our `_split_cors` validator unchanged.
+- **requirements.txt**: bumped `pydantic` 2.7.1 → 2.9.2 and `pydantic-settings` 2.2.1 → 2.7.0. The `NoDecode` annotation was only introduced in pydantic-settings 2.6+, so the older versions couldn't support the fix above. All 68 unit tests still pass with the new versions.
+
 ## [1.0.2] — 2026-06-20
 
 ### Fixed

app/config.py

@@ -13,9 +13,10 @@ from __future__ import annotations
 
 from functools import lru_cache
 from pathlib import Path
+from typing import Annotated
 
 from pydantic import Field, field_validator
-from pydantic_settings import BaseSettings, SettingsConfigDict
+from pydantic_settings import BaseSettings, NoDecode, SettingsConfigDict
 
 
 class Settings(BaseSettings):
@@ -37,7 +38,10 @@ class Settings(BaseSettings):
     jwt_algorithm: str = "HS256"
     access_token_expire_minutes: int = 60 * 24  # 24 hours
     refresh_token_expire_minutes: int = 60 * 24 * 7  # 7 days
-    cors_origins: list[str] = Field(default_factory=lambda: ["*"])
+    # `NoDecode` tells pydantic-settings to NOT JSON-parse the env var value
+    # before passing it to our `_split_cors` validator. Without it, the value
+    # `CORS_ORIGINS=http://a,http://b` would be rejected as invalid JSON.
+    cors_origins: Annotated[list[str], NoDecode] = Field(default_factory=lambda: ["*"])
 
     # === Admin setup ===
     admin_setup_token: str = ""  # if empty, will be auto-generated and stored in DB

requirements.txt

@@ -5,8 +5,8 @@ SQLAlchemy==2.0.30
 asyncpg==0.29.0
 alembic==1.13.1
 psycopg2-binary==2.9.9  # for alembic sync migrations
-pydantic==2.7.1
-pydantic-settings==2.2.1
+pydantic==2.9.2
+pydantic-settings==2.7.0
 email-validator==2.2.0  # required by pydantic.EmailStr
 python-jose[cryptography]==3.3.0
 passlib[bcrypt]==1.7.4