mirror of
https://github.com/Heretek-AI/AetherTable.git
synced 2026-11-07 10:45:58 -10:00
John SmithandClaude
beef779d51
- CORS: replace wildcard origins + credentials with an env-driven allowlist (CORS_ALLOW_ORIGINS), mirroring the engine's strict_cors. - identity: engine proxies (spawn/cast-spell/move/turn-next/damage/ reactions-arm, plus attack and death-save) now verify the caller's token and mint a forwarded-identity HMAC token carrying the real user_id and role, so the engine's RBAC authorizes the actual actor. Previously every proxied action spoke as 'orchestrator-service' with no role and was rejected ENTITY_NOT_OWNED on player-owned entities — deployed characters could not be driven end-to-end. Omitting the token keeps legacy service-mediated behavior. - tests: proxy identity forwarding, 401 on invalid tokens, contract route updated to act as GM. Co-Authored-By: Claude <[email protected]>
36 lines
763 B
Bash
36 lines
763 B
Bash
# VTT Environment Configurations
|
|
VTT_PORT=8080
|
|
ORCHESTRATOR_PORT=8000
|
|
CLIENT_PORT=3000
|
|
|
|
# Persistence
|
|
POSTGRES_USER=vtt_admin
|
|
POSTGRES_PASSWORD=vtt_secure_password_123
|
|
POSTGRES_DB=vtt_campaign_db
|
|
POSTGRES_HOST=postgres
|
|
POSTGRES_PORT=5432
|
|
|
|
NEO4J_AUTH=neo4j/vtt_neo4j_password
|
|
NEO4J_HOST=neo4j
|
|
NEO4J_PORT=7687
|
|
|
|
QDRANT_HOST=qdrant
|
|
QDRANT_PORT=6333
|
|
|
|
REDIS_HOST=redis
|
|
REDIS_PORT=6379
|
|
|
|
# Browser-facing CORS allowlist for the gateway (comma-separated origins).
|
|
CORS_ALLOW_ORIGINS=http://localhost:3000,http://127.0.0.1:3000
|
|
|
|
# Optional Cloud LLM API Keys (Falls back to local deterministic model if unset)
|
|
OPENAI_API_KEY=
|
|
ANTHROPIC_API_KEY=
|
|
GEMINI_API_KEY=
|
|
OLLAMA_BASE_URL=http://localhost:11434
|
|
|
|
#Custom Endpoint
|
|
LLM_API=http://example.com
|
|
LLM_KEY=test
|
|
LLM_MODEL=test
|