chat_backend/llm_be/llm_be/settings.py

"""
Django settings for llm_be project.

Environment-driven for local/dev/beta/prod (match company_site / scha).
"""

from pathlib import Path
from datetime import timedelta
from urllib.parse import urlparse
import json
import os

BASE_DIR = Path(__file__).resolve().parent.parent


def env(key: str, default: str | None = None) -> str | None:
    return os.environ.get(key, default)


def env_bool(key: str, default: bool = False) -> bool:
    value = os.environ.get(key)
    if value is None:
        return default
    return value.lower() in {"1", "true", "yes", "on"}


def env_list(key: str, default: str = "") -> list[str]:
    value = os.environ.get(key, default)
    if not value:
        return []
    value = value.strip()
    if value.startswith("["):
        try:
            parsed = json.loads(value)
        except ValueError:
            parsed = None
        if isinstance(parsed, list):
            return [str(item).strip() for item in parsed if str(item).strip()]
    return [item.strip() for item in value.split(",") if item.strip()]


def database_config() -> dict:
    database_url = env("DATABASE_URL")
    if database_url:
        parsed = urlparse(database_url)
        return {
            "default": {
                "ENGINE": "django.db.backends.postgresql",
                "NAME": parsed.path.lstrip("/"),
                "USER": parsed.username or "",
                "PASSWORD": parsed.password or "",
                "HOST": parsed.hostname or "",
                "PORT": str(parsed.port or 5432),
            }
        }

    if env("DB_HOST"):
        return {
            "default": {
                "ENGINE": "django.db.backends.postgresql",
                "NAME": env("DB_NAME", "chat_backend"),
                "USER": env("DB_USER", "chat_backend"),
                "PASSWORD": env("DB_PASSWORD", ""),
                "HOST": env("DB_HOST"),
                "PORT": env("DB_PORT", "5432"),
            }
        }

    return {
        "default": {
            "ENGINE": "django.db.backends.sqlite3",
            "NAME": BASE_DIR / "db.sqlite3",
        }
    }


# Capacitor WebView origins (Android https://localhost, iOS capacitor://localhost).
# Required so JWT API calls from native shells pass CORS/CSRF origin checks (#22).
CAPACITOR_WEBVIEW_ORIGINS = (
    "https://localhost",
    "capacitor://localhost",
    "http://localhost",
)


def build_csrf_trusted_origins(
    allowed_hosts: list[str], explicit: list[str] | None = None
) -> list[str]:
    if explicit:
        return list(explicit)

    local_hosts = {"localhost", "127.0.0.1", "0.0.0.0"}
    origins: list[str] = []
    for host in allowed_hosts:
        if not host or host == "*" or host.startswith("."):
            continue
        hostname = host.split(":")[0]
        scheme = "http" if hostname in local_hosts else "https"
        origins.append(f"{scheme}://{host}")
    return origins


def with_capacitor_webview_origins(origins: list[str]) -> list[str]:
    """Append Capacitor WebView origins without duplicates (order preserved)."""
    seen = set(origins)
    merged = list(origins)
    for origin in CAPACITOR_WEBVIEW_ORIGINS:
        if origin not in seen:
            merged.append(origin)
            seen.add(origin)
    return merged


DJANGO_ENV = (env("DJANGO_ENV", "dev") or "dev").lower()

SECRET_KEY = env(
    "DJANGO_SECRET_KEY",
    "django-insecure-dev-only-change-me-before-production",
)

DEBUG = env_bool("DJANGO_DEBUG", DJANGO_ENV == "dev")

allowed_hosts = env_list(
    "DJANGO_ALLOWED_HOSTS",
    "localhost,127.0.0.1,0.0.0.0,"
    "chatbackend.aimloperations.com,chat.aimloperations.com,"
    "beta.chatbackend.aimloperations.com,beta.chat.aimloperations.com",
)
ALLOWED_HOSTS = allowed_hosts if allowed_hosts else ["*"]

CSRF_TRUSTED_ORIGINS = with_capacitor_webview_origins(
    build_csrf_trusted_origins(
        ALLOWED_HOSTS,
        env_list("DJANGO_CSRF_TRUSTED_ORIGINS"),
    )
)

# JWT Authorization header only — no cookie credentials from the SPA/Capacitor shell.
CORS_ALLOW_CREDENTIALS = False
CORS_ORIGIN_ALLOW_ALL = env_bool("CORS_ORIGIN_ALLOW_ALL", True)
CORS_ALLOWED_ORIGINS = with_capacitor_webview_origins(
    env_list(
        "CORS_ALLOWED_ORIGINS",
        "http://localhost:3000,http://127.0.0.1:3000,"
        "https://chat.aimloperations.com,https://beta.chat.aimloperations.com",
    )
)

# Ollama — GPU host on LAN for deployed envs; loopback for local Ollama.
# Prod/beta control-node secret should set OLLAMA_BASE_URL=http://10.0.0.128:11434
OLLAMA_BASE_URL = (
    env("OLLAMA_BASE_URL", "http://127.0.0.1:11434") or "http://127.0.0.1:11434"
)
OLLAMA_MODEL = env(
    "OLLAMA_MODEL",
    "llama3.2" if not DEBUG else "gpt-oss:20b",
) or ("llama3.2" if not DEBUG else "gpt-oss:20b")
OLLAMA_EMBED_MODEL = env("OLLAMA_EMBED_MODEL", OLLAMA_MODEL) or OLLAMA_MODEL

CHROMA_PERSIST_DIRECTORY = env(
    "CHROMA_PERSIST_DIRECTORY",
    str(BASE_DIR / "chroma_db"),
) or str(BASE_DIR / "chroma_db")

INSTALLED_APPS = [
    "daphne",
    "django.contrib.admin",
    "django.contrib.auth",
    "django.contrib.contenttypes",
    "django.contrib.sessions",
    "django.contrib.messages",
    "whitenoise.runserver_nostatic",
    "django.contrib.staticfiles",
    "chat_backend",
    "finance",
    "rest_framework",
    "corsheaders",
    "rest_framework_simplejwt.token_blacklist",
]

MIDDLEWARE = [
    "django.middleware.security.SecurityMiddleware",
    "whitenoise.middleware.WhiteNoiseMiddleware",
    "django.contrib.sessions.middleware.SessionMiddleware",
    "corsheaders.middleware.CorsMiddleware",
    "django.middleware.common.CommonMiddleware",
    "django.middleware.csrf.CsrfViewMiddleware",
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "django.contrib.messages.middleware.MessageMiddleware",
    "django.middleware.clickjacking.XFrameOptionsMiddleware",
]

ROOT_URLCONF = "llm_be.urls"

TEMPLATES = [
    {
        "BACKEND": "django.template.backends.django.DjangoTemplates",
        "DIRS": [os.path.join(BASE_DIR, "templates")],
        "APP_DIRS": True,
        "OPTIONS": {
            "context_processors": [
                "django.template.context_processors.debug",
                "django.template.context_processors.request",
                "django.contrib.auth.context_processors.auth",
                "django.contrib.messages.context_processors.messages",
            ],
        },
    },
]

WSGI_APPLICATION = "llm_be.wsgi.application"
ASGI_APPLICATION = "llm_be.asgi.application"

DATABASES = database_config()

AUTH_PASSWORD_VALIDATORS = [
    {
        "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
    },
    {
        "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
    },
    {
        "NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
    },
    {
        "NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
    },
]

TEST_RUNNER = "llm_be.test_runner.ChatBackendTestRunner"

LANGUAGE_CODE = "en-us"
TIME_ZONE = "UTC"
USE_I18N = True
USE_L10N = True
USE_TZ = True

STATIC_URL = "/static/"
STATIC_ROOT = BASE_DIR / "staticfiles"
MEDIA_URL = "/media/"
MEDIA_ROOT = BASE_DIR / "media"

STORAGES = {
    "default": {
        "BACKEND": "chat_backend.storage.DatabaseStorage",
    },
    "staticfiles": {
        "BACKEND": "whitenoise.storage.CompressedManifestStaticFilesStorage",
    },
}

DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"

AUTH_USER_MODEL = "chat_backend.CustomUser"

REST_FRAMEWORK = {
    "DEFAULT_PERMISSION_CLASSES": ("rest_framework.permissions.IsAuthenticated",),
    "DEFAULT_AUTHENTICATION_CLASSES": (
        "rest_framework_simplejwt.authentication.JWTAuthentication",
    ),
}

SIMPLE_JWT = {
    "ACCESS_TOKEN_LIFETIME": timedelta(hours=5),
    "REFRESH_TOKEN_LIFETIME": timedelta(days=14),
    "ROTATE_REFRESH_TOKENS": True,
    "BLACKLIST_AFTER_ROTATION": True,
    "ALGORITHM": "HS256",
    "SIGNING_KEY": SECRET_KEY,
    "VERIFYING_KEY": None,
    "AUTH_HEADER_TYPES": ("JWT",),
    "USER_ID_FIELD": "id",
    "USER_ID_CLAIM": "user_id",
    "AUTH_TOKEN_CLASSES": ("rest_framework_simplejwt.tokens.AccessToken",),
    "TOKEN_TYPE_CLAIM": "token_type",
}

CHANNEL_LAYERS = {
    "default": {
        "BACKEND": "channels.layers.InMemoryChannelLayer",
    },
}

EMAIL_HOST = env("EMAIL_HOST", "mail.smtp2go.com") or "mail.smtp2go.com"
EMAIL_HOST_USER = env("EMAIL_HOST_USER", "") or ""
EMAIL_HOST_PASSWORD = env("EMAIL_HOST_PASSWORD", "") or ""
EMAIL_PORT = int(env("EMAIL_PORT", "2525") or "2525")
EMAIL_USE_TLS = env_bool("EMAIL_USE_TLS", True)

# Django 6 Tasks: ImmediateBackend runs in-process (no worker yet). Swap BACKEND
# to a durable queue + worker when SMTP should leave the request thread.
TASKS = {
    "default": {
        "BACKEND": "django.tasks.backends.immediate.ImmediateBackend",
    }
}

CAPTCHA_SECRET_KEY = env("CAPTCHA_SECRET_KEY", "") or ""

USE_TLS_PROXY = env_bool("USE_TLS_PROXY", DJANGO_ENV in {"prod", "beta"})
if USE_TLS_PROXY:
    SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")

directory_path = env("DJANGO_LOG_DIR", str(BASE_DIR / "logs")) or str(BASE_DIR / "logs")
os.makedirs(directory_path, exist_ok=True)

ALLOW_IMAGE_GENERATION = env_bool("ALLOW_IMAGE_GENERATION", False)
ALLOW_INTERNET_ACCESS = env_bool("ALLOW_INTERNET_ACCESS", True)

# Self-serve account registration (sign-up page). Default off — enable via
# control-node secret (chat_backend_<env>.env) when ready for public sign-up.
ENABLE_ACCOUNT_REGISTRATION = env_bool("ENABLE_ACCOUNT_REGISTRATION", False)

# ---------------------------------------------------------------------------
# OAuth SSO (Google / Microsoft) — #24
# ---------------------------------------------------------------------------
GOOGLE_OAUTH_CLIENT_ID = env("GOOGLE_OAUTH_CLIENT_ID", "") or ""
GOOGLE_OAUTH_CLIENT_SECRET = env("GOOGLE_OAUTH_CLIENT_SECRET", "") or ""
MICROSOFT_OAUTH_CLIENT_ID = env("MICROSOFT_OAUTH_CLIENT_ID", "") or ""
MICROSOFT_OAUTH_CLIENT_SECRET = env("MICROSOFT_OAUTH_CLIENT_SECRET", "") or ""
# Azure AD tenant: "common" (personal + work), "organizations", or a tenant ID.
MICROSOFT_OAUTH_TENANT = env("MICROSOFT_OAUTH_TENANT", "common") or "common"
# Public backend origin for IdP redirect URIs (e.g. https://chatbackend.aimloperations.com).
# When empty, callback URLs are built from the incoming request.
OAUTH_CALLBACK_BASE_URL = (env("OAUTH_CALLBACK_BASE_URL", "") or "").rstrip("/")

# ---------------------------------------------------------------------------
# Finance / Stripe (subscription billing)
# ---------------------------------------------------------------------------
STRIPE_SECRET_KEY = env("STRIPE_SECRET_KEY", "") or ""
STRIPE_PUBLISHABLE_KEY = env("STRIPE_PUBLISHABLE_KEY", "") or ""
STRIPE_WEBHOOK_SECRET = env("STRIPE_WEBHOOK_SECRET", "") or ""
# Optional: use a pre-created Stripe Price. When empty, Checkout uses
# price_data built from SUBSCRIPTION_PRICE_* below.
STRIPE_PRICE_ID = env("STRIPE_PRICE_ID", "") or ""

# Subscription list price — $10.00 USD / month (amount in cents).
SUBSCRIPTION_PRICE_AMOUNT_CENTS = int(
    env("SUBSCRIPTION_PRICE_AMOUNT_CENTS", "1000") or "1000"
)
SUBSCRIPTION_PRICE_CURRENCY = (
    env("SUBSCRIPTION_PRICE_CURRENCY", "usd") or "usd"
).lower()
SUBSCRIPTION_PRICE_INTERVAL = (
    env("SUBSCRIPTION_PRICE_INTERVAL", "month") or "month"
).lower()
SUBSCRIPTION_PRODUCT_NAME = (
    env("SUBSCRIPTION_PRODUCT_NAME", "Chat Subscription") or "Chat Subscription"
)

FRONTEND_BASE_URL = (
    env("FRONTEND_BASE_URL", "http://localhost:3000") or "http://localhost:3000"
).rstrip("/")
STRIPE_CHECKOUT_SUCCESS_URL = env(
    "STRIPE_CHECKOUT_SUCCESS_URL",
    f"{FRONTEND_BASE_URL}/billing/success?session_id={{CHECKOUT_SESSION_ID}}",
) or f"{FRONTEND_BASE_URL}/billing/success?session_id={{CHECKOUT_SESSION_ID}}"
STRIPE_CHECKOUT_CANCEL_URL = env(
    "STRIPE_CHECKOUT_CANCEL_URL",
    f"{FRONTEND_BASE_URL}/billing/cancel",
) or f"{FRONTEND_BASE_URL}/billing/cancel"
STRIPE_PORTAL_RETURN_URL = env(
    "STRIPE_PORTAL_RETURN_URL",
    f"{FRONTEND_BASE_URL}/account/",
) or f"{FRONTEND_BASE_URL}/account/"

if DJANGO_ENV in {"prod", "beta"}:
    # Compose treats $ in .env as variable expansion — escape each $ as $$.
    if not SECRET_KEY:
        raise ValueError(
            "DJANGO_SECRET_KEY is empty in prod/beta. Set it in the control-node "
            "secret (~/Documents/secrets/chat_backend/chat_backend_<env>.env). "
            "If the value contains $, write $$ or Compose will strip/empty it."
        )
    if SECRET_KEY.startswith("django-insecure") or "dev-only" in SECRET_KEY:
        raise ValueError(
            "DJANGO_SECRET_KEY still looks like a placeholder "
            "(starts with 'django-insecure' or contains 'dev-only'). "
            "Replace it with a real random secret and redeploy."
        )