Actualizo la app

.env.example

@@ -17,7 +17,7 @@ ORACULO_JWT_SECRET_KEY=replace-this-with-a-long-random-secret-at-least-32-chars
 ORACULO_JWT_ALGORITHM=HS256
 ORACULO_ACCESS_TOKEN_EXPIRE_MINUTES=60
 
-ORACULO_ALLOWED_HOSTS=localhost,127.0.0.1,*.hf.space,*.huggingface.co
+ORACULO_ALLOWED_HOSTS=localhost,127.0.0.1,diiegoal-oraculo-api.hf.space,*.hf.space,*.huggingface.co
 ORACULO_CORS_ALLOW_ORIGINS=http://localhost:3000,http://127.0.0.1:3000
 
 ORACULO_MAX_REQUEST_SIZE_BYTES=32768

app/core/config.py

@@ -4,6 +4,7 @@ import json
 from functools import lru_cache
 from pathlib import Path
 from typing import Annotated, Literal
+from urllib.parse import urlsplit
 
 from pydantic import Field, field_validator
 from pydantic_settings import BaseSettings, NoDecode, SettingsConfigDict
@@ -88,6 +89,54 @@ class Settings(BaseSettings):
                 return [str(item).strip() for item in parsed_value if str(item).strip()]
         return [item.strip() for item in value.split(",") if item.strip()]
 
+    @field_validator("allowed_hosts", mode="after")
+    @classmethod
+    def _normalize_allowed_hosts(cls, value: list[str]) -> list[str]:
+        normalized_hosts: list[str] = []
+        for raw_host in value:
+            normalized_host = cls._normalize_allowed_host(raw_host)
+            if normalized_host and normalized_host not in normalized_hosts:
+                normalized_hosts.append(normalized_host)
+        return normalized_hosts
+
+    @field_validator("cors_allow_origins", mode="after")
+    @classmethod
+    def _normalize_cors_allow_origins(cls, value: list[str]) -> list[str]:
+        normalized_origins: list[str] = []
+        for raw_origin in value:
+            normalized_origin = cls._normalize_origin(raw_origin)
+            if normalized_origin and normalized_origin not in normalized_origins:
+                normalized_origins.append(normalized_origin)
+        return normalized_origins
+
+    @staticmethod
+    def _normalize_allowed_host(value: str) -> str:
+        normalized_value = value.strip()
+        if not normalized_value or normalized_value == "*":
+            return normalized_value
+
+        candidate = normalized_value if "://" in normalized_value else f"//{normalized_value}"
+        parsed = urlsplit(candidate)
+        hostname = parsed.hostname or parsed.netloc
+        if hostname:
+            return hostname.strip().lower()
+
+        host_candidate = normalized_value.split("/", 1)[0].strip()
+        if "@" in host_candidate:
+            host_candidate = host_candidate.rsplit("@", 1)[-1]
+        return host_candidate.lower()
+
+    @staticmethod
+    def _normalize_origin(value: str) -> str:
+        normalized_value = value.strip().rstrip("/")
+        if not normalized_value or normalized_value == "*" or "://" not in normalized_value:
+            return normalized_value
+
+        parsed = urlsplit(normalized_value)
+        if not parsed.scheme or not parsed.netloc:
+            return normalized_value
+        return f"{parsed.scheme.lower()}://{parsed.netloc.lower()}"
+
     @property
     def base_dir(self) -> Path:
         return Path(__file__).resolve().parents[2]

tests/api/test_security_middleware.py

@@ -69,3 +69,22 @@ def test_trusted_host_middleware_rejects_invalid_hosts(client: TestClient) -> No
     response = client.get("/api/v1/health/live", headers={"Host": "evil.example.com"})
 
     assert response.status_code == 400
+
+
+def test_allowed_hosts_configuration_normalizes_full_urls(tmp_path) -> None:
+    settings = build_test_settings(
+        f"sqlite:///{tmp_path / 'trusted_hosts.db'}",
+        allowed_hosts=[
+            "localhost/docs",
+            "127.0.0.1:8000/docs",
+            "https://demo-space.hf.space/docs",
+        ],
+    )
+    app = create_app(settings=settings, model_manager=FakeModelManager())
+
+    with TestClient(app) as client:
+        localhost_response = client.get("/api/v1/health/live", headers={"Host": "localhost:8000"})
+        space_response = client.get("/api/v1/health/live", headers={"Host": "demo-space.hf.space"})
+
+    assert localhost_response.status_code == 200
+    assert space_response.status_code == 200