fix(sentry): derive env_prefix from FoundryContext

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: olivermeyer

src/aignostics_foundry_core/AGENTS.md

@@ -97,7 +97,7 @@ This file provides an overview of all modules in `aignostics_foundry_core`, thei
 
 - **Purpose**: Provides Auth0 cookie-based session authentication dependencies for FastAPI routes. All project-specific settings (org ID, role claim) are loaded from `AuthSettings` whose env prefix is configurable at instantiation.
 - **Key Features**:
-  - `AuthSettings(OpaqueSettings)` — reads from `FOUNDRY_AUTH_*` env vars by default; override prefix via constructor kwargs (e.g. `AuthSettings(_env_prefix="BRIDGE_AUTH_", _env_file=".env")`). Fields: `internal_org_id` (for internal org check), `auth0_role_claim` (JWT claim name for role)
+  - `AuthSettings(OpaqueSettings)` — uses the active FoundryContext.env_prefix to derive the env prefix (`{ctx.env_prefix}AUTH_`). Fields: `internal_org_id` (for internal org check), `auth0_role_claim` (JWT claim name for role)
   - `UnauthenticatedError(Exception)` — raised when a user session is missing or invalid
   - `ForbiddenError(ApiException)` — `status_code = 403`; raised when user lacks required role or org membership
   - `get_auth_client(request)` — retrieves `AuthClient` from `request.app.state.auth_client`; raises `RuntimeError` if not configured
@@ -154,7 +154,7 @@ This file provides an overview of all modules in `aignostics_foundry_core`, thei
 - **Purpose**: Bootstraps loguru as the primary logging framework, optionally redirecting stdlib `logging` via `InterceptHandler`. All project-specific constants are passed as parameters rather than hard-coded.
 - **Key Features**:
   - `InterceptHandler(logging.Handler)` — redirects stdlib log records to loguru, preserving original module/function/line metadata
-  - `LogSettings(BaseSettings)` — reads from `FOUNDRY_LOG_*` env vars by default; override prefix and env file via constructor kwargs (e.g. `LogSettings(_env_prefix="BRIDGE_LOG_", _env_file=".env")`). Fields: `level`, `stderr_enabled`, `file_enabled`, `file_name`, `redirect_logging`
+  - `LogSettings(BaseSettings)` — uses the active FoundryContext.env_prefix to derive the env prefix (`{ctx.env_prefix}LOG_`). Fields: `level`, `stderr_enabled`, `file_enabled`, `file_name`, `redirect_logging`
   - `logging_initialize(filter_func, *, context)` — removes all existing loguru handlers, then adds stderr/file handlers per settings; reads project name, version, and env file list from `context` (falls back to process-level context); embeds `project_name` and `version` in loguru `extra`; installs `InterceptHandler` for stdlib redirect; suppresses psycopg pool noise
 - **Location**: `aignostics_foundry_core/log.py`
 - **Dependencies**: `loguru>=0.7,<1`, `platformdirs>=4,<5` (mandatory)
@@ -166,7 +166,7 @@ This file provides an overview of all modules in `aignostics_foundry_core`, thei
 
 - **Purpose**: Bootstraps Sentry SDK with all project-specific metadata supplied as explicit parameters, making the initialisation reusable across any project without hard-coded constants.
 - **Key Features**:
-  - `SentrySettings(OpaqueSettings)` — reads from `FOUNDRY_SENTRY_*` env vars by default; override prefix and env file via constructor kwargs (e.g. `SentrySettings(_env_prefix="BRIDGE_SENTRY_", _env_file=".env")`). Fields: `enabled`, `dsn` (validated HTTPS Sentry URL), `debug`, `send_default_pii`, `max_breadcrumbs`, `sample_rate`, `traces_sample_rate`, `profiles_sample_rate`, `profile_session_sample_rate`, `profile_lifecycle`, `enable_logs`
+  - `SentrySettings(OpaqueSettings)` — uses the active FoundryContext.env_prefix to derive the env prefix (`{ctx.env_prefix}SENTRY_`). Fields: `enabled`, `dsn` (validated HTTPS Sentry URL), `debug`, `send_default_pii`, `max_breadcrumbs`, `sample_rate`, `traces_sample_rate`, `profiles_sample_rate`, `profile_session_sample_rate`, `profile_lifecycle`, `enable_logs`
   - `sentry_initialize(integrations, *, context=None)` — derives all project-specific values (name, version, environment, URLs, runtime flags) from *context* (or the global context); env prefix and env file are read from `ctx.env_prefix` and `ctx.env_file`; initialises Sentry SDK when enabled and DSN present; sets `aignx/base` context; suppresses noisy loggers; returns `True` on success, `False` otherwise
   - `set_sentry_user(user, role_claim)` — maps Auth0 user claims (`sub` → `id`, `email`, `name`, …) into Sentry scope; pass `None` to clear context; no-op when `sentry_sdk` is absent
 - **Location**: `aignostics_foundry_core/sentry.py`

src/aignostics_foundry_core/api/auth.py

@@ -5,7 +5,7 @@
 - Authentication dependencies (require_authenticated, require_admin, etc.)
 - get_user: Get authenticated user from session
 - get_auth_client: Get Auth0 client from app state
-- AuthSettings: Configurable auth settings (env prefix overridable via constructor kwargs)
+- AuthSettings: Auth settings whose env prefix is derived from the active FoundryContext
 """
 
 import time
@@ -17,6 +17,7 @@
 from loguru import logger
 from pydantic_settings import SettingsConfigDict
 
+from aignostics_foundry_core.foundry import get_context
 from aignostics_foundry_core.settings import OpaqueSettings, load_settings
 
 from .exceptions import ApiException
@@ -31,17 +32,21 @@
 
 
 class AuthSettings(OpaqueSettings):
-    """Auth settings with configurable env prefix.
+    """Auth settings whose env prefix is derived from the active FoundryContext.
 
-    Override prefix at instantiation:
-        ``AuthSettings(_env_prefix="BRIDGE_AUTH_", _env_file=".env")``
+    The effective prefix is ``{FoundryContext.env_prefix}AUTH_``, resolved at
+    instantiation time via :func:`aignostics_foundry_core.foundry.get_context`.
     """
 
-    model_config = SettingsConfigDict(env_prefix="FOUNDRY_AUTH_", extra="ignore")
+    model_config = SettingsConfigDict(extra="ignore")
 
     internal_org_id: str | None = None
     auth0_role_claim: str = DEFAULT_AUTH0_ROLE_CLAIM
 
+    def __init__(self, **kwargs: Any) -> None:  # noqa: ANN401
+        """Initialise settings, deriving env_prefix from the active FoundryContext."""
+        super().__init__(_env_prefix=f"{get_context().env_prefix}AUTH_", **kwargs)  # pyright: ignore[reportCallIssue]
+
 
 class UnauthenticatedError(Exception):
     """Raised when user is not authenticated."""

src/aignostics_foundry_core/log.py

@@ -14,7 +14,7 @@
 import os
 import sys
 from pathlib import Path
-from typing import TYPE_CHECKING, Literal
+from typing import TYPE_CHECKING, Any, Literal
 
 import platformdirs
 from loguru import logger
@@ -120,19 +120,20 @@ def patcher(record_dict: "Record") -> None:
 class LogSettings(BaseSettings):
     """Settings for configuring logging behaviour.
 
-    Reads from environment variables with the ``FOUNDRY_LOG_`` prefix by
-    default.  Callers can supply a project-specific prefix or env file at
-    instantiation time using Pydantic Settings v2 constructor kwargs::
-
-        settings = LogSettings(_env_prefix="BRIDGE_LOG_", _env_file=".env")
+    Reads environment variables using the prefix derived from the active
+    :class:`~aignostics_foundry_core.foundry.FoundryContext` (e.g.
+    ``MYPROJECT_LOG_`` when the context's ``env_prefix`` is ``MYPROJECT_``).
     """
 
     model_config = SettingsConfigDict(
-        env_prefix="FOUNDRY_LOG_",
         extra="ignore",
         env_file_encoding="utf-8",
     )
 
+    def __init__(self, **kwargs: Any) -> None:  # noqa: ANN401
+        """Initialise settings, deriving env_prefix from the active FoundryContext."""
+        super().__init__(_env_prefix=f"{get_context().env_prefix}LOG_", **kwargs)  # pyright: ignore[reportCallIssue]
+
     level: Literal["CRITICAL", "ERROR", "WARNING", "SUCCESS", "INFO", "DEBUG", "TRACE"] = Field(
         default="INFO",
         description="Log level, see https://loguru.readthedocs.io/en/stable/api/logger.html",
@@ -182,7 +183,7 @@ def logging_initialize(
             :func:`~aignostics_foundry_core.foundry.set_context`.
     """
     ctx = context or get_context()
-    settings = LogSettings(_env_prefix=f"{ctx.env_prefix}LOG_", _env_file=ctx.env_file)  # pyright: ignore[reportCallIssue]
+    settings = LogSettings(_env_file=ctx.env_file)  # pyright: ignore[reportCallIssue]
 
     logger.remove()  # Remove all default loggers
 

src/aignostics_foundry_core/sentry.py

@@ -118,19 +118,20 @@ def _validate_https_dsn(value: SecretStr | None) -> SecretStr | None:
 class SentrySettings(OpaqueSettings):
     """Configuration settings for Sentry integration.
 
-    Reads from environment variables with the ``FOUNDRY_SENTRY_`` prefix by
-    default. Callers can supply a project-specific prefix or env file at
-    instantiation time using Pydantic Settings v2 constructor kwargs::
-
-        settings = SentrySettings(_env_prefix="BRIDGE_SENTRY_", _env_file=".env")
+    Reads environment variables using the prefix derived from the active
+    :class:`~aignostics_foundry_core.foundry.FoundryContext` (e.g.
+    ``MYPROJECT_SENTRY_`` when the context's ``env_prefix`` is ``MYPROJECT_``).
     """
 
     model_config = SettingsConfigDict(
-        env_prefix="FOUNDRY_SENTRY_",
         env_file_encoding="utf-8",
         extra="ignore",
     )
 
+    def __init__(self, **kwargs: Any) -> None:  # noqa: ANN401
+        """Initialise settings, deriving env_prefix from the active FoundryContext."""
+        super().__init__(_env_prefix=f"{get_context().env_prefix}SENTRY_", **kwargs)  # pyright: ignore[reportCallIssue]
+
     enabled: Annotated[
         bool,
         Field(
@@ -245,7 +246,6 @@ def sentry_initialize(
     ctx = context or get_context()
 
     settings = SentrySettings(
-        _env_prefix=f"{ctx.env_prefix}SENTRY_",  # pyright: ignore[reportCallIssue]
         _env_file=ctx.env_file,  # pyright: ignore[reportCallIssue]
     )
 

tests/aignostics_foundry_core/api/auth_test.py

@@ -18,17 +18,25 @@
     require_internal,
     require_internal_admin,
 )
+from tests.conftest import make_context
 
 _PATCH_GET_USER = "aignostics_foundry_core.api.auth.get_user"
 _PATCH_GET_AUTH_CLIENT = "aignostics_foundry_core.api.auth.get_auth_client"
 _PATCH_SET_SENTRY_USER = "aignostics_foundry_core.sentry.set_sentry_user"
+_PATCH_GET_CONTEXT = "aignostics_foundry_core.api.auth.get_context"
 _INTERNAL_ORG_ID = "org_internal_123"
 _OTHER_ORG_ID = "org_other_456"
 _USER_NOT_AUTHENTICATED = "User is not authenticated"
 _USER_SUB = "auth0|x"
 _USER_EMAIL = "x@x.com"
 
 
+@pytest.fixture(autouse=True)
+def _stub_auth_get_context(monkeypatch: pytest.MonkeyPatch) -> None:  # pyright: ignore[reportUnusedFunction]
+    """Stub get_context for all auth tests to preserve FOUNDRY_AUTH_* env var names."""
+    monkeypatch.setattr(_PATCH_GET_CONTEXT, lambda: make_context("foundry", "FOUNDRY_"))
+
+
 @pytest.mark.unit
 class TestUnauthenticatedError:
     """Tests for UnauthenticatedError."""
@@ -91,6 +99,13 @@ def test_auth_settings_role_claim_value(self) -> None:
         """The default role claim is the Aignostics platform bridge claim URL."""
         assert DEFAULT_AUTH0_ROLE_CLAIM == "https://aignostics-platform-bridge/role"
 
+    def test_auth_settings_uses_context_env_prefix(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        """AuthSettings reads env vars from the prefix supplied by FoundryContext."""
+        monkeypatch.setattr(_PATCH_GET_CONTEXT, lambda: make_context("proj", "PROJ_"))
+        monkeypatch.setenv("PROJ_AUTH_AUTH0_ROLE_CLAIM", "https://custom/role")
+        settings = AuthSettings()
+        assert settings.auth0_role_claim == "https://custom/role"
+
 
 @pytest.mark.unit
 class TestGetUser:

tests/aignostics_foundry_core/log_test.py

@@ -25,9 +25,16 @@
 class TestLoggingInitialize:
     """Behavioural tests for logging_initialize()."""
 
+    @pytest.fixture(autouse=True)
+    def _stub_get_context(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.setattr(
+            "aignostics_foundry_core.log.get_context",
+            lambda: make_context(_PROJECT, env_prefix=f"{_PROJECT.upper()}_"),
+        )
+
     def test_logging_initialize_adds_stderr_handler(self, capsys: pytest.CaptureFixture[str]) -> None:
         """After initialization with defaults, a log message appears on stderr."""
-        logging_initialize(context=make_context(_PROJECT))
+        logging_initialize()
         from loguru import logger
 
         logger.info(_MARKER_MESSAGE)
@@ -39,7 +46,7 @@ def test_logging_initialize_skips_stderr_when_disabled(
     ) -> None:
         """When stderr is disabled via env var, no output is written to stderr."""
         monkeypatch.setenv(f"{_PROJECT.upper()}_LOG_STDERR_ENABLED", "false")
-        logging_initialize(context=make_context(_PROJECT, env_prefix=f"{_PROJECT.upper()}_"))
+        logging_initialize()
         from loguru import logger
 
         logger.info(_MARKER_MESSAGE)
@@ -48,7 +55,7 @@ def test_logging_initialize_skips_stderr_when_disabled(
 
     def test_intercept_handler_redirects_stdlib_log(self, capsys: pytest.CaptureFixture[str]) -> None:
         """After initialization, stdlib logging messages are forwarded to loguru (and thus stderr)."""
-        logging_initialize(context=make_context(_PROJECT))
+        logging_initialize()
         stdlib_logging.getLogger("test.intercept").warning(_STDLIB_MESSAGE)
         captured = capsys.readouterr()
         assert _STDLIB_MESSAGE in captured.err
@@ -60,7 +67,7 @@ def test_logging_initialize_file_handler_writes_to_file(
         log_file = tmp_path / "test.log"
         monkeypatch.setenv(f"{_PROJECT.upper()}_LOG_FILE_ENABLED", "true")
         monkeypatch.setenv(f"{_PROJECT.upper()}_LOG_FILE_NAME", str(log_file))
-        logging_initialize(context=make_context(_PROJECT, env_prefix=f"{_PROJECT.upper()}_"))
+        logging_initialize()
         from loguru import logger
 
         logger.info(_FILE_HANDLER_MARKER)
@@ -69,16 +76,16 @@ def test_logging_initialize_file_handler_writes_to_file(
 
     def test_logging_initialize_filter_func_is_applied(self, capsys: pytest.CaptureFixture[str]) -> None:
         """A filter_func returning False suppresses all output from the handler."""
-        logging_initialize(filter_func=lambda _: False, context=make_context(_PROJECT))
+        logging_initialize(filter_func=lambda _: False)
         from loguru import logger
 
         logger.info(_FILTER_MARKER)
         assert _FILTER_MARKER not in capsys.readouterr().err
 
     def test_logging_initialize_replaces_handlers_on_repeated_calls(self, capsys: pytest.CaptureFixture[str]) -> None:
         """Repeated calls replace existing handlers rather than accumulating them."""
-        logging_initialize(context=make_context(_PROJECT))
-        logging_initialize(context=make_context(_PROJECT))
+        logging_initialize()
+        logging_initialize()
         capsys.readouterr()  # Drain any buffered output from initialization
         from loguru import logger
 
@@ -87,13 +94,13 @@ def test_logging_initialize_replaces_handlers_on_repeated_calls(self, capsys: py
 
     def test_intercept_handler_drops_sentry_messages(self, capsys: pytest.CaptureFixture[str]) -> None:
         """InterceptHandler silently drops stdlib log messages containing 'sentry.io'."""
-        logging_initialize(context=make_context(_PROJECT))
+        logging_initialize()
         stdlib_logging.getLogger("test.sentry").warning(_SENTRY_MARKER)
         assert _SENTRY_MARKER not in capsys.readouterr().err
 
     def test_logging_initialize_suppresses_psycopg_loggers(self) -> None:
         """After logging_initialize(), psycopg loggers are set to WARNING to suppress noise."""
-        logging_initialize(context=make_context(_PROJECT))
+        logging_initialize()
         assert stdlib_logging.getLogger("psycopg").level == stdlib_logging.WARNING
         assert stdlib_logging.getLogger("psycopg.pool").level == stdlib_logging.WARNING
 
@@ -102,7 +109,7 @@ def test_logging_initialize_uses_context_project_name(
     ) -> None:
         """logging_initialize reads env-var prefix from context.name."""
         monkeypatch.setenv(f"{_PROJECT.upper()}_LOG_LEVEL", "DEBUG")
-        logging_initialize(context=make_context(_PROJECT, env_prefix=f"{_PROJECT.upper()}_"))
+        logging_initialize()
         from loguru import logger
 
         logger.debug(_MARKER_MESSAGE)
@@ -111,9 +118,13 @@ def test_logging_initialize_uses_context_project_name(
     def test_logging_initialize_respects_env_prefix_from_context(
         self, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
     ) -> None:
-        """logging_initialize uses ctx.env_prefix to resolve settings env vars."""
+        """LogSettings reads env vars from the prefix of the active get_context()."""
+        monkeypatch.setattr(
+            "aignostics_foundry_core.log.get_context",
+            lambda: make_context("myproject", env_prefix="MYPROJECT_"),
+        )
         monkeypatch.setenv("MYPROJECT_LOG_STDERR_ENABLED", "false")
-        logging_initialize(context=make_context("myproject", env_prefix="MYPROJECT_"))
+        logging_initialize()
         from loguru import logger
 
         logger.info(_MARKER_MESSAGE)
@@ -124,6 +135,24 @@ def test_logging_initialize_respects_env_prefix_from_context(
 class TestLogSettings:
     """Behavioural tests for LogSettings validation."""
 
+    @pytest.fixture(autouse=True)
+    def _stub_get_context(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.setattr(
+            "aignostics_foundry_core.log.get_context",
+            lambda: make_context(_PROJECT, env_prefix=f"{_PROJECT.upper()}_"),
+        )
+
+    @pytest.mark.unit
+    def test_log_settings_uses_context_env_prefix(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        """LogSettings reads env vars using the env_prefix from the active FoundryContext."""
+        monkeypatch.setattr(
+            "aignostics_foundry_core.log.get_context",
+            lambda: make_context("proj", env_prefix="PROJ_"),
+        )
+        monkeypatch.setenv("PROJ_LOG_STDERR_ENABLED", "false")
+        settings = LogSettings()  # pyright: ignore[reportCallIssue]
+        assert settings.stderr_enabled is False
+
     def test_log_settings_file_name_validation_rejects_directory(self, tmp_path: Path) -> None:
         """Passing an existing directory as file_name raises ValidationError when file_enabled."""
         with pytest.raises(ValidationError):