Fix Sentry fail-loud, startup validation, CORS defaults

backend/api/main.py

@@ -10,6 +10,7 @@ import logging
 import os
 import time
 from contextlib import asynccontextmanager
+from pathlib import Path
 
 from fastapi import FastAPI, Request, Response
 from fastapi.middleware.cors import CORSMiddleware
@@ -47,7 +48,10 @@ if _sentry_dsn:
         )
         log.info("Sentry enabled (env=%s)", os.environ.get("SENTRY_ENV", "production"))
     except ImportError:
-        log.warning("SENTRY_DSN set but sentry-sdk not installed — skipping")
+        raise RuntimeError(
+            "SENTRY_DSN is set but sentry-sdk is not installed. "
+            "Either install it (pip install sentry-sdk[fastapi]) or unset SENTRY_DSN."
+        )
 
 # ---------------------------------------------------------------------------
 # Lifespan — one-time startup / shutdown
@@ -56,11 +60,32 @@ if _sentry_dsn:
 _start_time: float = 0.0
 
 
+def _check_data_paths():
+    """Log warnings for missing data paths at startup."""
+    checks = {
+        "Data/daily_plan.json": "Control plan endpoint will return 404",
+        "Data/energy_predictor_model.pkl": "ML energy prediction will fall back to analytical",
+        "Data/ims/ims_merged_15min.csv": "IMS weather cache unavailable — forecast will need live fetch",
+    }
+    base = Path(__file__).resolve().parent.parent.parent
+    for rel_path, msg in checks.items():
+        if not (base / rel_path).exists():
+            log.warning("Missing %s — %s", rel_path, msg)
+
+
 @asynccontextmanager
 async def lifespan(app: FastAPI):
     global _start_time
     _start_time = time.time()
     log.info("SolarWine API starting (port 7860)")
+    _check_data_paths()
+
+    # Log auth status
+    if not os.environ.get("JWT_SECRET"):
+        log.warning("JWT_SECRET not set — all requests treated as read-only guest")
+    if not os.environ.get("ADMIN_PASSWORD"):
+        log.warning("ADMIN_PASSWORD not set — login endpoint disabled")
+
     yield
     log.info("SolarWine API shutting down (uptime=%.0fs)", get_uptime())
 
@@ -98,7 +123,13 @@ async def log_requests(request: Request, call_next):
 
 # -- CORS -------------------------------------------------------------------
 
-allowed_origins = os.environ.get("ALLOWED_ORIGINS", "http://localhost:3000,http://localhost:5173").split(",")
+_default_origins = ",".join([
+    "http://localhost:3000",
+    "http://localhost:5173",
+    "https://solarwine-api.hf.space",
+    "https://solarvine-dashboard.vercel.app",
+])
+allowed_origins = os.environ.get("ALLOWED_ORIGINS", _default_origins).split(",")
 app.add_middleware(
     CORSMiddleware,
     allow_origins=[o.strip() for o in allowed_origins],