chat_backend/llm_be/llm_be/settings.py

"""
Django settings for llm_be project.

Environment-driven for local/dev/beta/prod (match company_site / scha).
"""

from pathlib import Path
from datetime import timedelta
from urllib.parse import urlparse
import json
import os

BASE_DIR = Path(__file__).resolve().parent.parent


def env(key: str, default: str | None = None) -> str | None:
    return os.environ.get(key, default)


def env_bool(key: str, default: bool = False) -> bool:
    value = os.environ.get(key)
    if value is None:
        return default
    return value.lower() in {"1", "true", "yes", "on"}


def env_list(key: str, default: str = "") -> list[str]:
    value = os.environ.get(key, default)
    if not value:
        return []
    value = value.strip()
    if value.startswith("["):
        try:
            parsed = json.loads(value)
        except ValueError:
            parsed = None
        if isinstance(parsed, list):
            return [str(item).strip() for item in parsed if str(item).strip()]
    return [item.strip() for item in value.split(",") if item.strip()]


def database_config() -> dict:
    database_url = env("DATABASE_URL")
    if database_url:
        parsed = urlparse(database_url)
        return {
            "default": {
                "ENGINE": "django.db.backends.postgresql",
                "NAME": parsed.path.lstrip("/"),
                "USER": parsed.username or "",
                "PASSWORD": parsed.password or "",
                "HOST": parsed.hostname or "",
                "PORT": str(parsed.port or 5432),
            }
        }

    if env("DB_HOST"):
        return {
            "default": {
                "ENGINE": "django.db.backends.postgresql",
                "NAME": env("DB_NAME", "chat_backend"),
                "USER": env("DB_USER", "chat_backend"),
                "PASSWORD": env("DB_PASSWORD", ""),
                "HOST": env("DB_HOST"),
                "PORT": env("DB_PORT", "5432"),
            }
        }

    return {
        "default": {
            "ENGINE": "django.db.backends.sqlite3",
            "NAME": BASE_DIR / "db.sqlite3",
        }
    }


# Capacitor WebView origins (Android https://localhost, iOS capacitor://localhost).
# Required so JWT API calls from native shells pass CORS/CSRF origin checks (#22).
CAPACITOR_WEBVIEW_ORIGINS = (
    "https://localhost",
    "capacitor://localhost",
    "http://localhost",
)


def build_csrf_trusted_origins(
    allowed_hosts: list[str], explicit: list[str] | None = None
) -> list[str]:
    if explicit:
        return list(explicit)

    local_hosts = {"localhost", "127.0.0.1", "0.0.0.0"}
    origins: list[str] = []
    for host in allowed_hosts:
        if not host or host == "*" or host.startswith("."):
            continue
        hostname = host.split(":")[0]
        scheme = "http" if hostname in local_hosts else "https"
        origins.append(f"{scheme}://{host}")
    return origins


def with_capacitor_webview_origins(origins: list[str]) -> list[str]:
    """Append Capacitor WebView origins without duplicates (order preserved)."""
    seen = set(origins)
    merged = list(origins)
    for origin in CAPACITOR_WEBVIEW_ORIGINS:
        if origin not in seen:
            merged.append(origin)
            seen.add(origin)
    return merged


DJANGO_ENV = (env("DJANGO_ENV", "dev") or "dev").lower()

SECRET_KEY = env(
    "DJANGO_SECRET_KEY",
    "django-insecure-dev-only-change-me-before-production",
)

DEBUG = env_bool("DJANGO_DEBUG", DJANGO_ENV == "dev")

allowed_hosts = env_list(
    "DJANGO_ALLOWED_HOSTS",
    "localhost,127.0.0.1,0.0.0.0,"
    "chatbackend.aimloperations.com,chat.aimloperations.com,"
    "beta.chatbackend.aimloperations.com,beta.chat.aimloperations.com",
)
ALLOWED_HOSTS = allowed_hosts if allowed_hosts else ["*"]

CSRF_TRUSTED_ORIGINS = with_capacitor_webview_origins(
    build_csrf_trusted_origins(
        ALLOWED_HOSTS,
        env_list("DJANGO_CSRF_TRUSTED_ORIGINS"),
    )
)

# JWT Authorization header only — no cookie credentials from the SPA/Capacitor shell.
CORS_ALLOW_CREDENTIALS = False
CORS_ORIGIN_ALLOW_ALL = env_bool("CORS_ORIGIN_ALLOW_ALL", True)
CORS_ALLOWED_ORIGINS = with_capacitor_webview_origins(
    env_list(
        "CORS_ALLOWED_ORIGINS",
        "http://localhost:3000,http://127.0.0.1:3000,"
        "https://chat.aimloperations.com,https://beta.chat.aimloperations.com",
    )
)

# Ollama — GPU host on LAN for deployed envs; loopback for local Ollama.
# Prod/beta control-node secret should set OLLAMA_BASE_URL=http://10.0.0.128:11434
# Role-scoped models (#62). Dev and prod share the same defaults; override per
# role. ``OLLAMA_MODEL`` remains a fallback for THINKING so existing secrets
# keep working until role vars are set. Embeddings never fall back to a chat
# model.
OLLAMA_BASE_URL = (
    env("OLLAMA_BASE_URL", "http://127.0.0.1:11434") or "http://127.0.0.1:11434"
)
OLLAMA_MODEL = env("OLLAMA_MODEL", "gpt-oss:20b") or "gpt-oss:20b"
OLLAMA_MODEL_THINKING = env("OLLAMA_MODEL_THINKING", "") or OLLAMA_MODEL
OLLAMA_MODEL_FAST = env("OLLAMA_MODEL_FAST", "") or "gemma4:latest"
OLLAMA_MODEL_UTILITY = env("OLLAMA_MODEL_UTILITY", "") or "llama3.2"
OLLAMA_EMBED_MODEL = env("OLLAMA_EMBED_MODEL", "") or "nomic-embed-text"
OLLAMA_NUM_CTX_THINKING = int(
    env("OLLAMA_NUM_CTX_THINKING", "16384") or "16384"
)
OLLAMA_NUM_CTX_FAST = int(env("OLLAMA_NUM_CTX_FAST", "8192") or "8192")
OLLAMA_NUM_CTX_UTILITY = int(env("OLLAMA_NUM_CTX_UTILITY", "4096") or "4096")
# Agentic task execution roles (#63) — orchestrator plans/synthesises,
# sub-agents run independent plan steps on a smaller/cheaper model.
OLLAMA_MODEL_ORCHESTRATOR = env("OLLAMA_MODEL_ORCHESTRATOR", "") or OLLAMA_MODEL
OLLAMA_MODEL_SUBAGENT = env("OLLAMA_MODEL_SUBAGENT", "") or OLLAMA_MODEL_UTILITY
OLLAMA_NUM_CTX_ORCHESTRATOR = int(
    env("OLLAMA_NUM_CTX_ORCHESTRATOR", "16384") or "16384"
)
OLLAMA_NUM_CTX_SUBAGENT = int(env("OLLAMA_NUM_CTX_SUBAGENT", "8192") or "8192")

CHROMA_PERSIST_DIRECTORY = env(
    "CHROMA_PERSIST_DIRECTORY",
    str(BASE_DIR / "chroma_db"),
) or str(BASE_DIR / "chroma_db")

INSTALLED_APPS = [
    "daphne",
    "django.contrib.admin",
    "django.contrib.auth",
    "django.contrib.contenttypes",
    "django.contrib.sessions",
    "django.contrib.messages",
    "whitenoise.runserver_nostatic",
    "django.contrib.staticfiles",
    "chat_backend",
    "monetization.apps.MonetizationConfig",
    "rest_framework",
    "corsheaders",
    "rest_framework_simplejwt.token_blacklist",
]

MIDDLEWARE = [
    "django.middleware.security.SecurityMiddleware",
    "whitenoise.middleware.WhiteNoiseMiddleware",
    "django.contrib.sessions.middleware.SessionMiddleware",
    "corsheaders.middleware.CorsMiddleware",
    "django.middleware.common.CommonMiddleware",
    "django.middleware.csrf.CsrfViewMiddleware",
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "django.contrib.messages.middleware.MessageMiddleware",
    "django.middleware.clickjacking.XFrameOptionsMiddleware",
]

ROOT_URLCONF = "llm_be.urls"

TEMPLATES = [
    {
        "BACKEND": "django.template.backends.django.DjangoTemplates",
        "DIRS": [os.path.join(BASE_DIR, "templates")],
        "APP_DIRS": True,
        "OPTIONS": {
            "context_processors": [
                "django.template.context_processors.debug",
                "django.template.context_processors.request",
                "django.contrib.auth.context_processors.auth",
                "django.contrib.messages.context_processors.messages",
            ],
        },
    },
]

WSGI_APPLICATION = "llm_be.wsgi.application"
ASGI_APPLICATION = "llm_be.asgi.application"

DATABASES = database_config()

AUTH_PASSWORD_VALIDATORS = [
    {
        "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
    },
    {
        "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
    },
    {
        "NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
    },
    {
        "NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
    },
]

TEST_RUNNER = "llm_be.test_runner.ChatBackendTestRunner"

LANGUAGE_CODE = "en-us"
TIME_ZONE = "UTC"
USE_I18N = True
USE_L10N = True
USE_TZ = True

STATIC_URL = "/static/"
STATIC_ROOT = BASE_DIR / "staticfiles"
MEDIA_URL = "/media/"
MEDIA_ROOT = BASE_DIR / "media"

STORAGES = {
    "default": {
        "BACKEND": "chat_backend.storage.DatabaseStorage",
    },
    "staticfiles": {
        "BACKEND": "whitenoise.storage.CompressedManifestStaticFilesStorage",
    },
}

DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"

AUTH_USER_MODEL = "chat_backend.CustomUser"

REST_FRAMEWORK = {
    "DEFAULT_PERMISSION_CLASSES": ("rest_framework.permissions.IsAuthenticated",),
    "DEFAULT_AUTHENTICATION_CLASSES": (
        "rest_framework_simplejwt.authentication.JWTAuthentication",
    ),
}

SIMPLE_JWT = {
    "ACCESS_TOKEN_LIFETIME": timedelta(hours=5),
    "REFRESH_TOKEN_LIFETIME": timedelta(days=14),
    "ROTATE_REFRESH_TOKENS": True,
    "BLACKLIST_AFTER_ROTATION": True,
    "ALGORITHM": "HS256",
    "SIGNING_KEY": SECRET_KEY,
    "VERIFYING_KEY": None,
    "AUTH_HEADER_TYPES": ("JWT",),
    "USER_ID_FIELD": "id",
    "USER_ID_CLAIM": "user_id",
    "AUTH_TOKEN_CLASSES": ("rest_framework_simplejwt.tokens.AccessToken",),
    "TOKEN_TYPE_CLAIM": "token_type",
}

# Redis (#63) — optional. When unset, channel layer stays in-memory (single
# process; fine for dev/tests) and agent background work falls back to a
# daemon thread instead of a durable Celery queue (see TASKS / celery.py).
REDIS_URL = env("REDIS_URL", "") or ""
CELERY_BROKER_URL = env("CELERY_BROKER_URL", "") or REDIS_URL
CELERY_RESULT_BACKEND = env("CELERY_RESULT_BACKEND", "") or CELERY_BROKER_URL

if REDIS_URL:
    CHANNEL_LAYERS = {
        "default": {
            "BACKEND": "channels_redis.core.RedisChannelLayer",
            "CONFIG": {
                "hosts": [REDIS_URL],
            },
        },
    }
else:
    CHANNEL_LAYERS = {
        "default": {
            "BACKEND": "channels.layers.InMemoryChannelLayer",
        },
    }

EMAIL_HOST = env("EMAIL_HOST", "mail.smtp2go.com") or "mail.smtp2go.com"
EMAIL_HOST_USER = env("EMAIL_HOST_USER", "") or ""
EMAIL_HOST_PASSWORD = env("EMAIL_HOST_PASSWORD", "") or ""
EMAIL_PORT = int(env("EMAIL_PORT", "2525") or "2525")
EMAIL_USE_TLS = env_bool("EMAIL_USE_TLS", True)

# Django 6 Tasks: ImmediateBackend runs in-process (no worker yet). Swap BACKEND
# to a durable queue + worker when SMTP should leave the request thread.
# Drive sync / email keep using this (see drive_tasks.py / email_tasks.py).
# Agent runs (#63) are heavier/longer, so they use Celery directly (see
# llm_be/celery.py) when CELERY_BROKER_URL/REDIS_URL is configured; otherwise
# chat_backend.services.agent.tasks falls back to a daemon thread, mirroring
# the ImmediateBackend-over-a-thread pattern in drive_tasks.py.
TASKS = {
    "default": {
        "BACKEND": "django.tasks.backends.immediate.ImmediateBackend",
    }
}

CAPTCHA_SECRET_KEY = env("CAPTCHA_SECRET_KEY", "") or ""

USE_TLS_PROXY = env_bool("USE_TLS_PROXY", DJANGO_ENV in {"prod", "beta"})
if USE_TLS_PROXY:
    SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")

directory_path = env("DJANGO_LOG_DIR", str(BASE_DIR / "logs")) or str(BASE_DIR / "logs")
os.makedirs(directory_path, exist_ok=True)

ALLOW_IMAGE_GENERATION = env_bool("ALLOW_IMAGE_GENERATION", False)
ALLOW_INTERNET_ACCESS = env_bool("ALLOW_INTERNET_ACCESS", True)
# Web search (#62). Primary provider is SearxNG; DDGS is the automatic failover.
SEARCH_PROVIDER = (env("SEARCH_PROVIDER", "searxng") or "searxng").lower()
SEARCH_FAILOVER_PROVIDER = (
    env("SEARCH_FAILOVER_PROVIDER", "ddgs") or "ddgs"
).lower()
SEARXNG_BASE_URL = (
    env("SEARXNG_BASE_URL", "http://127.0.0.1:8080") or "http://127.0.0.1:8080"
).rstrip("/")
SEARXNG_TIMEOUT_SECONDS = float(env("SEARXNG_TIMEOUT_SECONDS", "8") or "8")
# When True, chat turns require an active plan and respect prompt/token quotas.
ENFORCE_SUBSCRIPTION_GATES = env_bool("ENFORCE_SUBSCRIPTION_GATES", True)

# ---------------------------------------------------------------------------
# Agentic task execution (#63) — long-running, multi-step tool-using turns.
# Default OFF: with this false, chat behaves exactly as the always-on grounded
# path (#62) — no planner, no tools, no AgentRun rows are created.
# ---------------------------------------------------------------------------
ALLOW_AGENTIC_TASKS = env_bool("ALLOW_AGENTIC_TASKS", False)
AGENT_MAX_PLAN_STEPS = int(env("AGENT_MAX_PLAN_STEPS", "8") or "8")
AGENT_MAX_ITERATIONS = int(env("AGENT_MAX_ITERATIONS", "12") or "12")
AGENT_WALL_CLOCK_SECONDS = int(env("AGENT_WALL_CLOCK_SECONDS", "600") or "600")
AGENT_SUBAGENT_CONCURRENCY = int(env("AGENT_SUBAGENT_CONCURRENCY", "3") or "3")
# Per-tool call budget/limits shared by services/tools.
AGENT_TOOL_TIMEOUT_SECONDS = float(env("AGENT_TOOL_TIMEOUT_SECONDS", "20") or "20")
AGENT_TOOL_OUTPUT_MAX_CHARS = int(
    env("AGENT_TOOL_OUTPUT_MAX_CHARS", "8000") or "8000"
)
AGENT_MAX_TOOL_CALLS_PER_RUN = int(
    env("AGENT_MAX_TOOL_CALLS_PER_RUN", "40") or "40"
)
# fetch_url response size cap (bytes) — independent of the text-truncation cap.
AGENT_FETCH_URL_MAX_BYTES = int(
    env("AGENT_FETCH_URL_MAX_BYTES", str(2 * 1024 * 1024)) or str(2 * 1024 * 1024)
)

# Self-serve account registration (sign-up page). Default off — enable via
# control-node secret (chat_backend_<env>.env) when ready for public sign-up.
ENABLE_ACCOUNT_REGISTRATION = env_bool("ENABLE_ACCOUNT_REGISTRATION", False)

# ---------------------------------------------------------------------------
# OAuth SSO (Google / Microsoft) — #24
# ---------------------------------------------------------------------------
GOOGLE_OAUTH_CLIENT_ID = env("GOOGLE_OAUTH_CLIENT_ID", "") or ""
GOOGLE_OAUTH_CLIENT_SECRET = env("GOOGLE_OAUTH_CLIENT_SECRET", "") or ""
MICROSOFT_OAUTH_CLIENT_ID = env("MICROSOFT_OAUTH_CLIENT_ID", "") or ""
MICROSOFT_OAUTH_CLIENT_SECRET = env("MICROSOFT_OAUTH_CLIENT_SECRET", "") or ""
# Azure AD tenant: "common" (personal + work), "organizations", or a tenant ID.
MICROSOFT_OAUTH_TENANT = env("MICROSOFT_OAUTH_TENANT", "common") or "common"
# Public backend origin for IdP redirect URIs (e.g. https://chatbackend.aimloperations.com).
# When empty, callback URLs are built from the incoming request.
OAUTH_CALLBACK_BASE_URL = (env("OAUTH_CALLBACK_BASE_URL", "") or "").rstrip("/")

# ---------------------------------------------------------------------------
# Monetization / Stripe + RevenueCat (subscription billing)
# ---------------------------------------------------------------------------
STRIPE_SECRET_KEY = env("STRIPE_SECRET_KEY", "") or ""
STRIPE_PUBLISHABLE_KEY = env("STRIPE_PUBLISHABLE_KEY", "") or ""
STRIPE_WEBHOOK_SECRET = env("STRIPE_WEBHOOK_SECRET", "") or ""
# Optional: use a pre-created Stripe Price. When empty, Checkout uses
# price_data built from SUBSCRIPTION_PRICE_* below.
STRIPE_PRICE_ID = env("STRIPE_PRICE_ID", "") or ""

# Legacy RevenueCat webhook secret. Store grants no longer use that webhook.
REVENUECAT_WEBHOOK_SECRET = env("REVENUECAT_WEBHOOK_SECRET", "") or ""
# Native store verification. Apple signed transactions chain to the bundled
# Apple Root CA G3 unless APPLE_IAP_ROOT_PEM adds another PEM.
APPLE_IAP_BUNDLE_ID = (
    env("APPLE_IAP_BUNDLE_ID", "ai.hesychia.chat") or "ai.hesychia.chat"
)
APPLE_IAP_ROOT_PEM = env("APPLE_IAP_ROOT_PEM", "") or ""
GOOGLE_PLAY_PACKAGE_NAME = (
    env("GOOGLE_PLAY_PACKAGE_NAME", "ai.hesychia.chat") or "ai.hesychia.chat"
)
GOOGLE_PLAY_SERVICE_ACCOUNT_JSON = (
    env("GOOGLE_PLAY_SERVICE_ACCOUNT_JSON", "") or ""
)
_rc_product_map_raw = env("REVENUECAT_PRODUCT_PLAN_MAP", "") or ""
REVENUECAT_PRODUCT_PLAN_MAP: dict = {}
if _rc_product_map_raw.strip():
    import json as _json

    try:
        parsed = _json.loads(_rc_product_map_raw)
        if isinstance(parsed, dict):
            REVENUECAT_PRODUCT_PLAN_MAP = {
                str(k): str(v) for k, v in parsed.items()
            }
    except _json.JSONDecodeError:
        REVENUECAT_PRODUCT_PLAN_MAP = {}

# Subscription list price — $10.00 USD / month (amount in cents).
SUBSCRIPTION_PRICE_AMOUNT_CENTS = int(
    env("SUBSCRIPTION_PRICE_AMOUNT_CENTS", "1000") or "1000"
)
SUBSCRIPTION_PRICE_CURRENCY = (
    env("SUBSCRIPTION_PRICE_CURRENCY", "usd") or "usd"
).lower()
SUBSCRIPTION_PRICE_INTERVAL = (
    env("SUBSCRIPTION_PRICE_INTERVAL", "month") or "month"
).lower()
SUBSCRIPTION_PRODUCT_NAME = (
    env("SUBSCRIPTION_PRODUCT_NAME", "Founders") or "Founders"
)

FRONTEND_BASE_URL = (
    env("FRONTEND_BASE_URL", "http://localhost:3000") or "http://localhost:3000"
).rstrip("/")
STRIPE_CHECKOUT_SUCCESS_URL = env(
    "STRIPE_CHECKOUT_SUCCESS_URL",
    f"{FRONTEND_BASE_URL}/billing/success?session_id={{CHECKOUT_SESSION_ID}}",
) or f"{FRONTEND_BASE_URL}/billing/success?session_id={{CHECKOUT_SESSION_ID}}"
STRIPE_CHECKOUT_CANCEL_URL = env(
    "STRIPE_CHECKOUT_CANCEL_URL",
    f"{FRONTEND_BASE_URL}/billing/cancel",
) or f"{FRONTEND_BASE_URL}/billing/cancel"
STRIPE_PORTAL_RETURN_URL = env(
    "STRIPE_PORTAL_RETURN_URL",
    f"{FRONTEND_BASE_URL}/account/",
) or f"{FRONTEND_BASE_URL}/account/"

if DJANGO_ENV in {"prod", "beta"}:
    # Compose treats $ in .env as variable expansion — escape each $ as $$.
    if not SECRET_KEY:
        raise ValueError(
            "DJANGO_SECRET_KEY is empty in prod/beta. Set it in the control-node "
            "secret (~/Documents/secrets/chat_backend/chat_backend_<env>.env). "
            "If the value contains $, write $$ or Compose will strip/empty it."
        )
    if SECRET_KEY.startswith("django-insecure") or "dev-only" in SECRET_KEY:
        raise ValueError(
            "DJANGO_SECRET_KEY still looks like a placeholder "
            "(starts with 'django-insecure' or contains 'dev-only'). "
            "Replace it with a real random secret and redeploy."
        )