Harden DocumentDB client: safe URI lookup + conditional TLS cert bypass

clinical-note-similarity-py/.env.example

@@ -1,6 +1,9 @@
-DOCUMENTDB_URI=mongodb://<username>:<password>@localhost:10260/?tls=true&tlsAllowInvalidCertificates=true&authMechanism=SCRAM-SHA-256
+DOCUMENTDB_URI=mongodb://<username>:<password>@localhost:10260/?tls=true&authMechanism=SCRAM-SHA-256
 DOCUMENTDB_DATABASE=clinicaldb
 DOCUMENTDB_COLLECTION=notes
+# Set to "true" only when using a local container with a self-signed certificate.
+# Leave unset or "false" for real deployments with a valid TLS certificate.
+DOCUMENTDB_ALLOW_INVALID_CERTS=false
 OLLAMA_BASE_URL=http://127.0.0.1:11434
 OLLAMA_EMBEDDING_MODEL=nomic-embed-text
 FLASK_PORT=5001

clinical-note-similarity-py/utils/db.py

@@ -1,11 +1,17 @@
 import os
+import sys
 
 from pymongo import MongoClient
 
 
 def get_client() -> MongoClient:
-    uri = os.environ["DOCUMENTDB_URI"]
-    return MongoClient(uri, tlsAllowInvalidCertificates=True)
+    uri = os.getenv("DOCUMENTDB_URI")
+    if not uri:
+        sys.exit("Error: DOCUMENTDB_URI environment variable is not set. Please configure it before running.")
+    allow_invalid_certs = os.getenv("DOCUMENTDB_ALLOW_INVALID_CERTS", "false").lower() in ("1", "true", "yes")
+    if allow_invalid_certs:
+        return MongoClient(uri, tlsAllowInvalidCertificates=True)
+    return MongoClient(uri)
 
 
 def get_collection(client: MongoClient):

fraud-detection-agent-py/.env.example

@@ -1,6 +1,9 @@
-DOCUMENTDB_URI=mongodb://<username>:<password>@localhost:10260/?tls=true&tlsAllowInvalidCertificates=true&authMechanism=SCRAM-SHA-256
+DOCUMENTDB_URI=mongodb://<username>:<password>@localhost:10260/?tls=true&authMechanism=SCRAM-SHA-256
 DOCUMENTDB_DATABASE=frauddb
 DOCUMENTDB_COLLECTION=transactions
+# Set to "true" only when using a local container with a self-signed certificate.
+# Leave unset or "false" for real deployments with a valid TLS certificate.
+DOCUMENTDB_ALLOW_INVALID_CERTS=false
 OLLAMA_BASE_URL=http://127.0.0.1:11434
 OLLAMA_EMBEDDING_MODEL=nomic-embed-text
 OLLAMA_LLM_MODEL=llama3.2

fraud-detection-agent-py/utils/db.py

@@ -1,11 +1,17 @@
 import os
+import sys
 
 from pymongo import MongoClient
 
 
 def get_client() -> MongoClient:
-    uri = os.environ["DOCUMENTDB_URI"]
-    return MongoClient(uri, tlsAllowInvalidCertificates=True)
+    uri = os.getenv("DOCUMENTDB_URI")
+    if not uri:
+        sys.exit("Error: DOCUMENTDB_URI environment variable is not set. Please configure it before running.")
+    allow_invalid_certs = os.getenv("DOCUMENTDB_ALLOW_INVALID_CERTS", "false").lower() in ("1", "true", "yes")
+    if allow_invalid_certs:
+        return MongoClient(uri, tlsAllowInvalidCertificates=True)
+    return MongoClient(uri)
 
 
 def get_collection(client: MongoClient):