fix: harden kyc startup and beorg errors

src/infrastructure/beorg/client.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 from typing import Any
 import aiohttp
+from pydantic import ValidationError
 from src.application.contracts import IBeorgService
 from src.application.domain.dto import BeorgKycCreateResponse,BeorgKycResultResponse
 from src.application.domain.exceptions import BeorgConfigException,BeorgRejectedException,BeorgUnavailableException
@@ -50,11 +51,16 @@ class BeorgService(IBeorgService):
             raise BeorgUnavailableException() from None
         except aiohttp.ClientError:
             raise BeorgUnavailableException() from None
+        except (ValueError,ValidationError):
+            raise BeorgUnavailableException() from None
 
         if response.status >= 500:
             raise BeorgUnavailableException()
 
-        result = BeorgKycCreateResponse.model_validate(data)
+        try:
+            result = BeorgKycCreateResponse.model_validate(data)
+        except ValidationError:
+            raise BeorgUnavailableException() from None
         if not result.status:
             raise BeorgRejectedException(result.error or 'Beorg rejected kyc request')
 
@@ -79,11 +85,16 @@ class BeorgService(IBeorgService):
             raise BeorgUnavailableException() from None
         except aiohttp.ClientError:
             raise BeorgUnavailableException() from None
+        except (ValueError,ValidationError):
+            raise BeorgUnavailableException() from None
 
         if response.status >= 500:
             raise BeorgUnavailableException()
 
-        return BeorgKycResultResponse.model_validate(data)
+        try:
+            return BeorgKycResultResponse.model_validate(data)
+        except ValidationError:
+            raise BeorgUnavailableException() from None
 
 
     def _ensure_configured(self) -> None:

src/infrastructure/config/settings.py

@@ -14,6 +14,7 @@ class Settings(BaseSettings):
 
     DOCS_USERNAME: str = 'admin'
     DOCS_PASSWORD: str = 'admin'
+    CORS_ALLOW_ORIGIN_REGEX: str = r'https?://([a-z0-9-]+\.)*elcsa\.ru(:\d+)?$'
     VAULT_ADDR: str = 'https://corp.vault.elcsa.ru'
     VAULT_ROLE_ID: str = ''
     VAULT_SECRET_ID: str = ''

src/main.py

@@ -84,10 +84,12 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
     app.state.jwt_key_store = jwt_store
     app.state.jwt_keys_scheduler = jwt_scheduler
     app.state.kyc_scheduler = kyc_scheduler
-    yield
+    try:
-    app.state.kyc_scheduler.shutdown(wait=False)
+        yield
-    app.state.jwt_keys_scheduler.shutdown(wait=False)
+    finally:
-    logger.info(f'Users service instance ended with id {instance_id}')
+        app.state.kyc_scheduler.shutdown(wait=False)
+        app.state.jwt_keys_scheduler.shutdown(wait=False)
+        logger.info(f'KYC service instance ended with id {instance_id}')
 
 
 app: FastAPI = FastAPI(
@@ -126,7 +128,7 @@ app.add_middleware(
 app.add_middleware(
     CORSMiddleware,
     allow_origins=[],
-    allow_origin_regex='.*',
+    allow_origin_regex=settings.CORS_ALLOW_ORIGIN_REGEX,
     allow_credentials=True,
     allow_methods=['*'],
     allow_headers=['*'],