feat(cloud): validate control plane and host configuration

tests/test_cloud_control_config.py

@@ -0,0 +1,75 @@
+from __future__ import annotations
+
+import pytest
+
+from cloud.control_config import (
+    CloudConfigurationError,
+    CloudControlConfig,
+    load_control_config,
+)
+
+
+def test_load_control_config_uses_safe_local_defaults() -> None:
+    assert load_control_config({}) == CloudControlConfig()
+
+
+def test_load_control_config_parses_deployment_values() -> None:
+    config = load_control_config(
+        {
+            "CLOUD_ENVIRONMENT": "production",
+            "CLOUD_DATABASE_URL": "postgresql+psycopg://cloud@db/cloud",
+            "CLOUD_SCHEDULER_INTERVAL_SECONDS": "2.5",
+            "CLOUD_LEASE_REAPER_INTERVAL_SECONDS": "7",
+            "CLOUD_LEASE_DURATION_SECONDS": "90",
+            "CLOUD_MAX_TASK_ATTEMPTS": "5",
+        }
+    )
+
+    assert config.environment == "production"
+    assert config.database_url.startswith("postgresql+psycopg://")
+    assert config.scheduler_interval_seconds == 2.5
+    assert config.max_task_attempts == 5
+
+
+@pytest.mark.parametrize(
+    "environment,database_url",
+    [("invalid", "sqlite:///test.db"), ("local", "mysql://db/cloud")],
+)
+def test_load_control_config_rejects_invalid_environment_or_database(
+    environment: str,
+    database_url: str,
+) -> None:
+    with pytest.raises(CloudConfigurationError):
+        load_control_config(
+            {
+                "CLOUD_ENVIRONMENT": environment,
+                "CLOUD_DATABASE_URL": database_url,
+            }
+        )
+
+
+def test_load_control_config_rejects_unsafe_production_anonymous_mode() -> None:
+    with pytest.raises(CloudConfigurationError, match="production"):
+        load_control_config(
+            {
+                "CLOUD_ENVIRONMENT": "production",
+                "CLOUD_DATABASE_URL": "postgresql://db/cloud",
+                "CLOUD_ALLOW_INSECURE_ANONYMOUS": "true",
+            }
+        )
+
+
+@pytest.mark.parametrize(
+    "name,value",
+    [
+        ("CLOUD_SCHEDULER_INTERVAL_SECONDS", "0"),
+        ("CLOUD_LEASE_DURATION_SECONDS", "invalid"),
+        ("CLOUD_MAX_TASK_ATTEMPTS", "-1"),
+    ],
+)
+def test_load_control_config_rejects_invalid_numeric_values(
+    name: str,
+    value: str,
+) -> None:
+    with pytest.raises(CloudConfigurationError):
+        load_control_config({name: value})