manavgup
diff --git a/‎backend/core/config.py‎
Lines changed: 85 additions & 7 deletions b/‎backend/core/config.py‎
Lines changed: 85 additions & 7 deletions
diff --git a/‎backend/main.py‎
Lines changed: 7 additions & 2 deletions b/‎backend/main.py‎
Lines changed: 7 additions & 2 deletions
diff --git a/‎backend/rag_solution/core/dependencies.py‎
Lines changed: 8 additions & 0 deletions b/‎backend/rag_solution/core/dependencies.py‎
Lines changed: 8 additions & 0 deletions
diff --git a/‎backend/rag_solution/models/__init__.py‎
Lines changed: 2 additions & 0 deletions b/‎backend/rag_solution/models/__init__.py‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎backend/rag_solution/models/runtime_config.py‎
Lines changed: 154 additions & 0 deletions b/‎backend/rag_solution/models/runtime_config.py‎
Lines changed: 154 additions & 0 deletions
@@ -4,7 +4,7 @@
 import tempfile
 from functools import lru_cache
 from pathlib import Path
-from typing import Annotated
+from typing import Annotated, Any
 
 from pydantic import field_validator
 from pydantic.fields import Field
@@ -407,20 +407,98 @@ class Settings(BaseSettings):
     @field_validator("jwt_secret_key")
     @classmethod
     def validate_jwt_secret(cls, v: str | None) -> str | None:
-        """Validate JWT secret key and warn if using default in production."""
-        if v and "dev-secret-key" in v and os.getenv("ENVIRONMENT", "").lower() in ("production", "prod"):
+        """Validate JWT secret key and warn if using default or weak secret.
+
+        Checks for common weak patterns:
+        - Default development secrets (dev-secret-key, changeme, secret)
+        - Short secrets (< 32 characters)
+        - Production environment with weak secrets
+
+        Args:
+            v: JWT secret key value
+
+        Returns:
+            str | None: Validated secret key (warnings logged for weak secrets)
+        """
+        if not v:
+            return v
+
+        weak_patterns = ["dev-secret-key", "changeme", "secret", "test", "password"]
+        is_production = os.getenv("ENVIRONMENT", "").lower() in ("production", "prod")
+
+        # Check for weak secret patterns
+        if any(pattern in v.lower() for pattern in weak_patterns):
+            msg = "⚠️  Weak JWT secret detected! Using common/default pattern."
+            if is_production:
+                msg += " This is a CRITICAL security risk in production!"
             try:
                 logger = get_logger(__name__)
-                logger.warning("⚠️  Using default JWT secret in production! Set JWT_SECRET_KEY environment variable.")
+                logger.warning(msg)
             except ImportError:
-                # Fallback to print if logging utils not available
-                print("⚠️  Using default JWT secret in production! Set JWT_SECRET_KEY environment variable.")
+                print(msg)
+
+        # Check secret length (should be at least 32 chars for HS256)
+        if len(v) < 32:
+            msg = f"⚠️  JWT secret is only {len(v)} characters. Recommended: 32+ characters."
+            if is_production:
+                msg += " This weakens token security!"
+            try:
+                logger = get_logger(__name__)
+                logger.warning(msg)
+            except ImportError:
+                print(msg)
+
+        return v
+
+    @field_validator("wx_api_key", "openai_api_key", "anthropic_api_key")
+    @classmethod
+    def validate_api_keys(cls, v: str | None, info: Any) -> str | None:
+        """Validate API keys for weak or placeholder values.
+
+        Args:
+            v: API key value
+            info: Pydantic ValidationInfo with field_name
+
+        Returns:
+            str | None: Validated API key (warnings logged for weak keys)
+        """
+        if not v:
+            return v
+
+        field_name = info.field_name if hasattr(info, "field_name") else "API key"
+        weak_patterns = ["changeme", "secret", "test", "placeholder", "your-api-key", "xxx"]
+
+        # Check for placeholder/weak patterns
+        if any(pattern in v.lower() for pattern in weak_patterns):
+            msg = f"⚠️  Invalid/placeholder value for {field_name}. Please set a valid API key."
+            try:
+                logger = get_logger(__name__)
+                logger.warning(msg)
+            except ImportError:
+                print(msg)
+
+        # Check minimum length (most API keys are 20+ chars)
+        if len(v) < 20:
+            msg = f"⚠️  {field_name} seems too short ({len(v)} chars). Verify it's correct."
+            try:
+                logger = get_logger(__name__)
+                logger.warning(msg)
+            except ImportError:
+                print(msg)
+
         return v
 
     @field_validator("rag_llm")
     @classmethod
     def validate_rag_llm(cls, v: str) -> str:
-        """Validate RAG LLM model name."""
+        """Validate RAG LLM model name.
+
+        Args:
+            v: LLM model identifier
+
+        Returns:
+            str: Validated model name (defaults to granite if empty)
+        """
         # Accept any non-empty string as LLM model name
         if not v or not v.strip():
             try:
 
@@ -38,7 +38,9 @@
 from rag_solution.router.dashboard_router import router as dashboard_router
 from rag_solution.router.health_router import router as health_router
 from rag_solution.router.podcast_router import router as podcast_router
+from rag_solution.router.runtime_config_router import router as runtime_config_router
 from rag_solution.router.search_router import router as search_router
+from rag_solution.router.settings_router import router as settings_router
 from rag_solution.router.team_router import router as team_router
 from rag_solution.router.token_warning_router import router as token_warning_router
 from rag_solution.router.user_router import router as user_router
@@ -141,11 +143,12 @@ async def lifespan(_app: FastAPI) -> AsyncGenerator[None, None]:
             # This is critical when .env settings change between restarts
             from rag_solution.generation.providers.factory import LLMProviderFactory
 
-            factory = LLMProviderFactory(db)
+            settings = get_settings()
+            factory = LLMProviderFactory(db, settings)
             factory.cleanup_all()
             logger.info("Cleared cached provider instances")
 
-            system_init_service = SystemInitializationService(db, get_settings())
+            system_init_service = SystemInitializationService(db, settings)
             providers = system_init_service.initialize_providers(raise_on_error=True)
             logger.info("Initialized providers: %s", ", ".join(p.name for p in providers))
 
@@ -213,6 +216,8 @@ async def lifespan(_app: FastAPI) -> AsyncGenerator[None, None]:
 app.include_router(health_router)
 app.include_router(collection_router)
 app.include_router(podcast_router)
+app.include_router(runtime_config_router)
+app.include_router(settings_router)
 app.include_router(user_router)
 app.include_router(team_router)
 app.include_router(search_router)
 
@@ -18,6 +18,7 @@
 from rag_solution.schemas.user_schema import UserOutput
 from rag_solution.services.collection_service import CollectionService
 from rag_solution.services.file_management_service import FileManagementService
+from rag_solution.services.llm_parameters_service import LLMParametersService
 from rag_solution.services.llm_provider_service import LLMProviderService
 from rag_solution.services.pipeline_service import PipelineService
 from rag_solution.services.question_service import QuestionService
@@ -287,3 +288,10 @@ def get_question_service(db: Session = Depends(get_db), settings: Settings = Dep
 def get_search_service(db: Session = Depends(get_db), settings: Settings = Depends(get_settings)) -> SearchService:
     """Get SearchService instance with proper dependency injection."""
     return SearchService(db, settings)
+
+
+def get_llm_parameters_service(
+    db: Session = Depends(get_db), settings: Settings = Depends(get_settings)
+) -> LLMParametersService:
+    """Get LLMParametersService instance with proper dependency injection."""
+    return LLMParametersService(db, settings)
@@ -16,6 +16,7 @@
 from rag_solution.models.podcast import Podcast
 from rag_solution.models.prompt_template import PromptTemplate
 from rag_solution.models.question import SuggestedQuestion
+from rag_solution.models.runtime_config import RuntimeConfig
 
 # Then the rest of the models
 from rag_solution.models.team import Team
@@ -38,6 +39,7 @@
     "LLMParameters",
     "Podcast",
     "PromptTemplate",
+    "RuntimeConfig",
     "SuggestedQuestion",
     "Team",
     "TokenWarning",
 
@@ -0,0 +1,154 @@
+"""RuntimeConfig model for operational overrides and feature flags.
+
+This model stores runtime operational configuration that can be changed without
+application restart. It is designed for admin-level controls, feature flags,
+A/B testing, and emergency overrides.
+
+Use Cases:
+    - Feature flags: Enable/disable experimental features
+    - Emergency overrides: Force-disable problematic functionality
+    - A/B testing: Enable features for specific users/collections
+    - Performance tuning: Adjust batch sizes, timeouts, retry counts
+    - Circuit breakers: Disable failing external services
+
+NOT for:
+    - User preferences: Use PipelineConfig.config_metadata instead
+    - Collection-specific settings: Use PipelineConfig.config_metadata instead
+    - LLM parameters per user: Use LLMParameters table instead
+    - Infrastructure config: Use .env and Settings class instead
+
+Configuration precedence: collection > user > global > .env Settings
+"""
+
+from __future__ import annotations
+
+import uuid
+from datetime import datetime
+from typing import TYPE_CHECKING, Any
+
+from sqlalchemy import Boolean, DateTime, Enum, String, Text, UniqueConstraint
+from sqlalchemy.dialects.postgresql import JSONB, UUID
+from sqlalchemy.orm import Mapped, mapped_column
+from sqlalchemy.sql import func
+
+from core.identity_service import IdentityService
+from rag_solution.file_management.database import Base
+from rag_solution.schemas.runtime_config_schema import ConfigCategory, ConfigScope
+
+if TYPE_CHECKING:
+    pass
+
+
+class RuntimeConfig(Base):  # pylint: disable=too-few-public-methods
+    """Operational configuration override with hierarchical scope.
+
+    This model enables runtime changes to system behavior without restart.
+    Intended for admin-level operational controls, not end-user preferences.
+
+    Examples:
+        Global feature flag:
+            scope='GLOBAL', category='SYSTEM', config_key='enable_new_reranker',
+            config_value={'value': True, 'type': 'bool'}
+
+        Emergency override:
+            scope='GLOBAL', category='OVERRIDE', config_key='force_disable_reranking',
+            config_value={'value': True, 'type': 'bool'}
+
+        User A/B test:
+            scope='USER', category='EXPERIMENT', config_key='enable_semantic_chunking',
+            user_id='...', config_value={'value': True, 'type': 'bool'}
+
+        Performance tuning:
+            scope='GLOBAL', category='PERFORMANCE', config_key='embedding_batch_size',
+            config_value={'value': 10, 'type': 'int'}
+
+    Attributes:
+        id: Unique identifier
+        scope: Configuration scope (GLOBAL/USER/COLLECTION)
+        category: Configuration category (SYSTEM/OVERRIDE/EXPERIMENT/PERFORMANCE)
+        config_key: Configuration key (e.g., 'enable_new_reranker')
+        config_value: JSONB with type metadata: {'value': ..., 'type': 'int'|'float'|'str'|'bool'|'list'|'dict'}
+        user_id: Optional user ID for USER/COLLECTION scopes
+        collection_id: Optional collection ID for COLLECTION scope
+        is_active: Whether this configuration is currently active
+        description: Optional human-readable description
+        created_by: User ID who created this configuration
+        created_at: Creation timestamp
+        updated_at: Last update timestamp
+
+    Constraints:
+        - Unique constraint on (scope, category, config_key, user_id, collection_id)
+        - Ensures only one config per scope/category/key/user/collection combination
+    """
+
+    __tablename__ = "runtime_configs"
+
+    # 🆔 Identification
+    id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True), primary_key=True, default=IdentityService.generate_id
+    )
+
+    # ⚙️ Configuration Attributes
+    scope: Mapped[ConfigScope] = mapped_column(
+        Enum(ConfigScope, name="configscope", create_type=False), nullable=False, index=True
+    )
+    category: Mapped[ConfigCategory] = mapped_column(
+        Enum(ConfigCategory, name="configcategory", create_type=False), nullable=False, index=True
+    )
+    config_key: Mapped[str] = mapped_column(String(255), nullable=False, index=True)
+
+    # 💾 Configuration Value (JSONB for flexible type storage)
+    config_value: Mapped[dict[str, Any]] = mapped_column(
+        JSONB, nullable=False, comment="JSON with type metadata: {'value': ..., 'type': 'int'|'float'|'str'|...}"
+    )
+
+    # 🔗 Foreign Keys (nullable for global scope)
+    user_id: Mapped[uuid.UUID | None] = mapped_column(
+        UUID(as_uuid=True), nullable=True, index=True, comment="Required for USER/COLLECTION scopes"
+    )
+    collection_id: Mapped[uuid.UUID | None] = mapped_column(
+        UUID(as_uuid=True), nullable=True, index=True, comment="Required for COLLECTION scope"
+    )
+
+    # 🟢 Flags
+    is_active: Mapped[bool] = mapped_column(Boolean, default=True, nullable=False, index=True)
+
+    # 📝 Metadata
+    description: Mapped[str | None] = mapped_column(Text, nullable=True)
+    created_by: Mapped[uuid.UUID | None] = mapped_column(UUID(as_uuid=True), nullable=True)
+
+    # 📊 Timestamps
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), onupdate=func.now()
+    )
+
+    # 🔐 Unique Constraint
+    # Ensures only one config per scope/category/key/user/collection combination
+    __table_args__ = (
+        UniqueConstraint(
+            "scope",
+            "category",
+            "config_key",
+            "user_id",
+            "collection_id",
+            name="uq_runtime_config_scope_category_key_user_collection",
+        ),
+        {"extend_existing": True},
+    )
+
+    # 🔗 Relationships (TYPE_CHECKING imports prevent circular dependencies)
+    # Note: Relationships to User and Collection models are optional
+    # They enable ORM navigation but are not required for basic functionality
+    # Uncomment if bidirectional navigation is needed:
+    #
+    # user: Mapped[User | None] = relationship("User", back_populates="runtime_configs")
+    # collection: Mapped[Collection | None] = relationship("Collection", back_populates="runtime_configs")
+
+    def __repr__(self) -> str:
+        """String representation for debugging."""
+        return (
+            f"<RuntimeConfig(id={self.id}, scope={self.scope}, "
+            f"category={self.category}, key={self.config_key}, "
+            f"user_id={self.user_id}, collection_id={self.collection_id})>"
+        )