Harden DocumentDB client: safe URI lookup + conditional TLS cert bypass

[Copilot]

get_client() in all three samples used os.environ["DOCUMENTDB_URI"] (bare KeyError on missing var) and hardcoded tlsAllowInvalidCertificates=True unconditionally, disabling certificate validation even in production deployments.

Changes

• fraud-detection-agent-py/utils/db.py and clinical-note-similarity-py/utils/db.py

  • Replace os.environ[...] with os.getenv(...) + sys.exit(...) on missing URI
  • Gate tlsAllowInvalidCertificates behind DOCUMENTDB_ALLOW_INVALID_CERTS env flag (consistent with the already-fixed content-semantic-search-py)

• .env.example (both samples)

  • Remove tlsAllowInvalidCertificates=true from the sample URI
  • Document the new DOCUMENTDB_ALLOW_INVALID_CERTS flag

def get_client() -> MongoClient:
    uri = os.getenv("DOCUMENTDB_URI")
    if not uri:
        sys.exit("Error: DOCUMENTDB_URI environment variable is not set. Please configure it before running.")
    allow_invalid_certs = os.getenv("DOCUMENTDB_ALLOW_INVALID_CERTS", "false").lower() in ("1", "true", "yes")
    if allow_invalid_certs:
        return MongoClient(uri, tlsAllowInvalidCertificates=True)
    return MongoClient(uri)

DOCUMENTDB_ALLOW_INVALID_CERTS defaults to false; set it to true only for local containers with self-signed certificates.

---

📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.