339 lines
10 KiB
Python
339 lines
10 KiB
Python
import os
|
|
from datetime import timedelta
|
|
|
|
from corsheaders.defaults import default_headers
|
|
from dotenv import load_dotenv
|
|
|
|
# Build paths inside the project like this: os.path.join(BASE_DIR, ...)
|
|
BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
|
|
|
|
load_dotenv()
|
|
|
|
# SECURITY WARNING: keep the secret key used in production secret!
|
|
SECRET_KEY = os.environ["SECRET_KEY"]
|
|
|
|
# SECURITY WARNING: don't run with debug turned on in production!
|
|
DEBUG = os.environ.get("DEBUG", "False").lower() == "true"
|
|
|
|
# Security: Restrict allowed hosts - set ALLOWED_HOSTS env var in production
|
|
ALLOWED_HOSTS = os.environ.get("ALLOWED_HOSTS", "localhost,127.0.0.1").split(",")
|
|
|
|
INSTALLED_APPS = [
|
|
"django.contrib.auth",
|
|
"django.contrib.admin",
|
|
"django.contrib.contenttypes",
|
|
"django.contrib.messages",
|
|
"django.contrib.sessions",
|
|
"django.contrib.staticfiles",
|
|
"rest_framework",
|
|
"rest_framework_simplejwt",
|
|
"corsheaders",
|
|
"django_ses",
|
|
"drf_spectacular",
|
|
"common",
|
|
"accounts",
|
|
"cases",
|
|
"contacts",
|
|
"leads",
|
|
"opportunity",
|
|
"tasks",
|
|
"invoices",
|
|
# "teams", # Merged into common app
|
|
]
|
|
|
|
MIDDLEWARE = [
|
|
"django.middleware.security.SecurityMiddleware",
|
|
"whitenoise.middleware.WhiteNoiseMiddleware",
|
|
"django.middleware.common.CommonMiddleware",
|
|
"django.contrib.sessions.middleware.SessionMiddleware",
|
|
"django.middleware.csrf.CsrfViewMiddleware", # CSRF protection
|
|
"django.contrib.auth.middleware.AuthenticationMiddleware",
|
|
"django.contrib.messages.middleware.MessageMiddleware",
|
|
"django.middleware.clickjacking.XFrameOptionsMiddleware",
|
|
"corsheaders.middleware.CorsMiddleware",
|
|
"crum.CurrentRequestUserMiddleware",
|
|
"common.middleware.get_company.GetProfileAndOrg",
|
|
"common.middleware.rls_context.RequireOrgContext", # RLS: Enforce org context + set PostgreSQL session variable
|
|
]
|
|
|
|
ROOT_URLCONF = "crm.urls"
|
|
|
|
TEMPLATES = [
|
|
{
|
|
"BACKEND": "django.template.backends.django.DjangoTemplates",
|
|
"DIRS": [
|
|
os.path.join(BASE_DIR, "templates"),
|
|
],
|
|
"APP_DIRS": True,
|
|
"OPTIONS": {
|
|
"context_processors": [
|
|
"django.template.context_processors.debug",
|
|
"django.template.context_processors.request",
|
|
"django.contrib.auth.context_processors.auth",
|
|
"django.contrib.messages.context_processors.messages",
|
|
"common.context_processors.common.app_name",
|
|
# "django_settings_export.settings_export",
|
|
],
|
|
},
|
|
},
|
|
]
|
|
|
|
WSGI_APPLICATION = "crm.wsgi.application"
|
|
|
|
# Database
|
|
# https://docs.djangoproject.com/en/1.10/ref/settings/#databases
|
|
|
|
DATABASES = {
|
|
"default": {
|
|
"ENGINE": "django.db.backends.postgresql",
|
|
"NAME": os.environ["DBNAME"],
|
|
"USER": os.environ["DBUSER"],
|
|
"PASSWORD": os.environ["DBPASSWORD"],
|
|
"HOST": os.environ["DBHOST"],
|
|
"PORT": os.environ["DBPORT"],
|
|
}
|
|
}
|
|
|
|
|
|
# Password validation
|
|
# https://docs.djangoproject.com/en/1.10/ref/settings/#auth-password-validators
|
|
|
|
AUTH_PASSWORD_VALIDATORS = [
|
|
{
|
|
"NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
|
|
},
|
|
{
|
|
"NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
|
|
},
|
|
{
|
|
"NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
|
|
},
|
|
{
|
|
"NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
|
|
},
|
|
]
|
|
|
|
# Internationalization
|
|
# https://docs.djangoproject.com/en/1.10/topics/i18n/
|
|
|
|
|
|
TIME_ZONE = "Asia/Kolkata"
|
|
|
|
USE_I18N = True
|
|
|
|
USE_TZ = True
|
|
|
|
EMAIL_BACKEND = "django.core.mail.backends.console.EmailBackend"
|
|
|
|
AUTH_USER_MODEL = "common.User"
|
|
|
|
STATIC_ROOT = os.path.join(BASE_DIR, "staticfiles")
|
|
STATIC_URL = "/static/"
|
|
STATICFILES_DIRS = [os.path.join(BASE_DIR, "static")]
|
|
|
|
ENV_TYPE = os.environ["ENV_TYPE"]
|
|
if ENV_TYPE == "dev":
|
|
MEDIA_ROOT = os.path.join(BASE_DIR, "media")
|
|
MEDIA_URL = "/media/"
|
|
elif ENV_TYPE == "prod":
|
|
from .server_settings import *
|
|
|
|
DEFAULT_FROM_EMAIL = os.environ["DEFAULT_FROM_EMAIL"]
|
|
ADMIN_EMAIL = os.environ["ADMIN_EMAIL"]
|
|
|
|
|
|
# celery Tasks
|
|
CELERY_BROKER_URL = os.environ["CELERY_BROKER_URL"]
|
|
CELERY_RESULT_BACKEND = os.environ["CELERY_RESULT_BACKEND"]
|
|
|
|
|
|
LOGGING = {
|
|
"version": 1,
|
|
"disable_existing_loggers": False,
|
|
"filters": {
|
|
"require_debug_false": {
|
|
"()": "django.utils.log.RequireDebugFalse",
|
|
},
|
|
"require_debug_true": {
|
|
"()": "django.utils.log.RequireDebugTrue",
|
|
},
|
|
},
|
|
"formatters": {
|
|
"django.server": {
|
|
"()": "django.utils.log.ServerFormatter",
|
|
"format": "[%(server_time)s] %(message)s",
|
|
},
|
|
"security": {
|
|
"format": "%(asctime)s | %(levelname)s | %(message)s",
|
|
"datefmt": "%Y-%m-%d %H:%M:%S",
|
|
},
|
|
},
|
|
"handlers": {
|
|
"console": {
|
|
"level": "INFO",
|
|
"filters": ["require_debug_true"],
|
|
"class": "logging.StreamHandler",
|
|
},
|
|
"console_debug_false": {
|
|
"level": "ERROR",
|
|
"filters": ["require_debug_false"],
|
|
"class": "logging.StreamHandler",
|
|
},
|
|
"django.server": {
|
|
"level": "INFO",
|
|
"class": "logging.StreamHandler",
|
|
"formatter": "django.server",
|
|
},
|
|
"mail_admins": {
|
|
"level": "ERROR",
|
|
"filters": ["require_debug_false"],
|
|
"class": "django.utils.log.AdminEmailHandler",
|
|
},
|
|
"logfile": {
|
|
"class": "logging.FileHandler",
|
|
"filename": "server.log",
|
|
},
|
|
"security_audit": {
|
|
"class": "logging.FileHandler",
|
|
"filename": "security_audit.log",
|
|
"formatter": "security",
|
|
},
|
|
},
|
|
"loggers": {
|
|
"django": {
|
|
"handlers": [
|
|
"console",
|
|
"console_debug_false",
|
|
"logfile",
|
|
],
|
|
"level": "INFO",
|
|
},
|
|
"django.server": {
|
|
"handlers": ["django.server"],
|
|
"level": "INFO",
|
|
"propagate": False,
|
|
},
|
|
"security.audit": {
|
|
"handlers": ["security_audit", "console"],
|
|
"level": "INFO",
|
|
"propagate": False,
|
|
},
|
|
},
|
|
}
|
|
|
|
APPLICATION_NAME = "bottlecrm"
|
|
|
|
SETTINGS_EXPORT = ["APPLICATION_NAME"]
|
|
|
|
REST_FRAMEWORK = {
|
|
"EXCEPTION_HANDLER": "rest_framework.views.exception_handler",
|
|
"DEFAULT_AUTHENTICATION_CLASSES": (
|
|
"rest_framework_simplejwt.authentication.JWTAuthentication",
|
|
"common.external_auth.APIKeyAuthentication",
|
|
# "rest_framework.authentication.SessionAuthentication",
|
|
# "rest_framework.authentication.BasicAuthentication",
|
|
),
|
|
"DEFAULT_PAGINATION_CLASS": "rest_framework.pagination.LimitOffsetPagination",
|
|
"PAGE_SIZE": 10,
|
|
"DEFAULT_SCHEMA_CLASS": "drf_spectacular.openapi.AutoSchema",
|
|
}
|
|
|
|
|
|
SPECTACULAR_SETTINGS = {
|
|
"TITLE": "BottleCRM API",
|
|
"DESCRIPTION": "Open source CRM application",
|
|
"VERSION": "1.0.0",
|
|
"SERVE_INCLUDE_SCHEMA": False,
|
|
"COMPONENT_SPLIT_REQUEST": True,
|
|
"PREPROCESSING_HOOKS": ["common.custom_openapi.preprocessing_filter_spec"],
|
|
"ENUM_NAME_OVERRIDES": {
|
|
# Role enums
|
|
"ProfileRoleEnum": "common.utils.ROLES",
|
|
"BoardMemberRoleEnum": "tasks.models.BoardMember.ROLE_CHOICES",
|
|
# Priority enums
|
|
"TaskPriorityEnum": "tasks.models.Task.PRIORITY_CHOICES",
|
|
"CasePriorityEnum": "common.utils.PRIORITY_CHOICE",
|
|
"BoardTaskPriorityEnum": "tasks.models.BoardTask.PRIORITY_CHOICES",
|
|
# Status enums
|
|
"TaskStatusEnum": "tasks.models.Task.STATUS_CHOICES",
|
|
"CaseStatusEnum": "common.utils.STATUS_CHOICE",
|
|
"SolutionStatusEnum": "cases.models.Solution.STATUS_CHOICES",
|
|
"DocumentStatusEnum": "common.models.Document.DOCUMENT_STATUS_CHOICE",
|
|
"InvoiceStatusEnum": "invoices.models.Invoice.INVOICE_STATUS",
|
|
"ContactFormStatusEnum": "common.models.ContactFormSubmission.STATUS_CHOICES",
|
|
"LeadStatusEnum": "common.utils.LEAD_STATUS",
|
|
},
|
|
}
|
|
|
|
# JWT_SETTINGS = {
|
|
# 'bearerFormat': ('Bearer', 'jwt', 'Jwt')
|
|
# }
|
|
|
|
SWAGGER_SETTINGS = {
|
|
"DEFAULT_INFO": "crm.urls.info",
|
|
"SECURITY_DEFINITIONS": {
|
|
"Bearer": {
|
|
"type": "apiKey",
|
|
"name": "Authorization",
|
|
"in": "header",
|
|
"description": "Enter 'Bearer <token>'",
|
|
},
|
|
},
|
|
}
|
|
|
|
CORS_ALLOW_HEADERS = default_headers + ("org",)
|
|
# Security: CORS configuration via environment variables
|
|
CORS_ORIGIN_ALLOW_ALL = os.environ.get("CORS_ALLOW_ALL", "False").lower() == "true"
|
|
CORS_ALLOWED_ORIGINS = [
|
|
origin.strip()
|
|
for origin in os.environ.get(
|
|
"CORS_ALLOWED_ORIGINS", "http://localhost:5173,http://127.0.0.1:5173"
|
|
).split(",")
|
|
if origin.strip()
|
|
]
|
|
# Security: CSRF trusted origins via environment variable
|
|
_csrf_origins = os.environ.get("CSRF_TRUSTED_ORIGINS", "")
|
|
CSRF_TRUSTED_ORIGINS = [o.strip() for o in _csrf_origins.split(",") if o.strip()]
|
|
|
|
# Security: HSTS with 1 year duration (recommended minimum)
|
|
SECURE_HSTS_SECONDS = 31536000 # 1 year
|
|
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
|
|
SECURE_HSTS_PRELOAD = True
|
|
SECURE_CONTENT_TYPE_NOSNIFF = True
|
|
|
|
DEFAULT_AUTO_FIELD = "django.db.models.AutoField"
|
|
|
|
STATICFILES_STORAGE = "whitenoise.storage.CompressedManifestStaticFilesStorage"
|
|
# STATICFILES_STORAGE = 'django.contrib.staticfiles.storage.ManifestStaticFilesStorage'
|
|
|
|
DOMAIN_NAME = os.getenv("DOMAIN_NAME")
|
|
|
|
|
|
SIMPLE_JWT = {
|
|
# Security: Reduced token lifetimes
|
|
"ACCESS_TOKEN_LIFETIME": timedelta(hours=1),
|
|
"REFRESH_TOKEN_LIFETIME": timedelta(days=14),
|
|
# Security: Enable token rotation to invalidate old refresh tokens
|
|
"ROTATE_REFRESH_TOKENS": True,
|
|
"BLACKLIST_AFTER_ROTATION": True,
|
|
"UPDATE_LAST_LOGIN": False,
|
|
"ALGORITHM": "HS256",
|
|
"SIGNING_KEY": SECRET_KEY,
|
|
"VERIFYING_KEY": None,
|
|
"AUDIENCE": None,
|
|
"ISSUER": None,
|
|
"AUTH_HEADER_NAME": "HTTP_AUTHORIZATION",
|
|
"USER_ID_FIELD": "id",
|
|
"USER_ID_CLAIM": "user_id",
|
|
}
|
|
# it is needed in custome middlewere to get the user from the token
|
|
JWT_ALGO = "HS256"
|
|
|
|
|
|
DOMAIN_NAME = os.environ["DOMAIN_NAME"]
|
|
SWAGGER_ROOT_URL = os.environ["SWAGGER_ROOT_URL"]
|
|
|
|
# Google OAuth Configuration
|
|
GOOGLE_CLIENT_ID = os.environ.get("GOOGLE_CLIENT_ID", "")
|
|
GOOGLE_CLIENT_SECRET = os.environ.get("GOOGLE_CLIENT_SECRET", "")
|
|
GOOGLE_REDIRECT_URI = os.environ.get("GOOGLE_REDIRECT_URI", "")
|