westfarn
be6ff471ad
Introduce OAuthIdentity storage, start/callback endpoints, JWT handoff to the SPA, and mocked IdP tests so Drive OAuth (#11) can reuse the same model.
375 lines
12 KiB
Python
375 lines
12 KiB
Python
"""
|
|
Django settings for llm_be project.
|
|
|
|
Environment-driven for local/dev/beta/prod (match company_site / scha).
|
|
"""
|
|
|
|
from pathlib import Path
|
|
from datetime import timedelta
|
|
from urllib.parse import urlparse
|
|
import json
|
|
import os
|
|
|
|
BASE_DIR = Path(__file__).resolve().parent.parent
|
|
|
|
|
|
def env(key: str, default: str | None = None) -> str | None:
|
|
return os.environ.get(key, default)
|
|
|
|
|
|
def env_bool(key: str, default: bool = False) -> bool:
|
|
value = os.environ.get(key)
|
|
if value is None:
|
|
return default
|
|
return value.lower() in {"1", "true", "yes", "on"}
|
|
|
|
|
|
def env_list(key: str, default: str = "") -> list[str]:
|
|
value = os.environ.get(key, default)
|
|
if not value:
|
|
return []
|
|
value = value.strip()
|
|
if value.startswith("["):
|
|
try:
|
|
parsed = json.loads(value)
|
|
except ValueError:
|
|
parsed = None
|
|
if isinstance(parsed, list):
|
|
return [str(item).strip() for item in parsed if str(item).strip()]
|
|
return [item.strip() for item in value.split(",") if item.strip()]
|
|
|
|
|
|
def database_config() -> dict:
|
|
database_url = env("DATABASE_URL")
|
|
if database_url:
|
|
parsed = urlparse(database_url)
|
|
return {
|
|
"default": {
|
|
"ENGINE": "django.db.backends.postgresql",
|
|
"NAME": parsed.path.lstrip("/"),
|
|
"USER": parsed.username or "",
|
|
"PASSWORD": parsed.password or "",
|
|
"HOST": parsed.hostname or "",
|
|
"PORT": str(parsed.port or 5432),
|
|
}
|
|
}
|
|
|
|
if env("DB_HOST"):
|
|
return {
|
|
"default": {
|
|
"ENGINE": "django.db.backends.postgresql",
|
|
"NAME": env("DB_NAME", "chat_backend"),
|
|
"USER": env("DB_USER", "chat_backend"),
|
|
"PASSWORD": env("DB_PASSWORD", ""),
|
|
"HOST": env("DB_HOST"),
|
|
"PORT": env("DB_PORT", "5432"),
|
|
}
|
|
}
|
|
|
|
return {
|
|
"default": {
|
|
"ENGINE": "django.db.backends.sqlite3",
|
|
"NAME": BASE_DIR / "db.sqlite3",
|
|
}
|
|
}
|
|
|
|
|
|
# Capacitor WebView origins (Android https://localhost, iOS capacitor://localhost).
|
|
# Required so JWT API calls from native shells pass CORS/CSRF origin checks (#22).
|
|
CAPACITOR_WEBVIEW_ORIGINS = (
|
|
"https://localhost",
|
|
"capacitor://localhost",
|
|
"http://localhost",
|
|
)
|
|
|
|
|
|
def build_csrf_trusted_origins(
|
|
allowed_hosts: list[str], explicit: list[str] | None = None
|
|
) -> list[str]:
|
|
if explicit:
|
|
return list(explicit)
|
|
|
|
local_hosts = {"localhost", "127.0.0.1", "0.0.0.0"}
|
|
origins: list[str] = []
|
|
for host in allowed_hosts:
|
|
if not host or host == "*" or host.startswith("."):
|
|
continue
|
|
hostname = host.split(":")[0]
|
|
scheme = "http" if hostname in local_hosts else "https"
|
|
origins.append(f"{scheme}://{host}")
|
|
return origins
|
|
|
|
|
|
def with_capacitor_webview_origins(origins: list[str]) -> list[str]:
|
|
"""Append Capacitor WebView origins without duplicates (order preserved)."""
|
|
seen = set(origins)
|
|
merged = list(origins)
|
|
for origin in CAPACITOR_WEBVIEW_ORIGINS:
|
|
if origin not in seen:
|
|
merged.append(origin)
|
|
seen.add(origin)
|
|
return merged
|
|
|
|
|
|
DJANGO_ENV = (env("DJANGO_ENV", "dev") or "dev").lower()
|
|
|
|
SECRET_KEY = env(
|
|
"DJANGO_SECRET_KEY",
|
|
"django-insecure-dev-only-change-me-before-production",
|
|
)
|
|
|
|
DEBUG = env_bool("DJANGO_DEBUG", DJANGO_ENV == "dev")
|
|
|
|
allowed_hosts = env_list(
|
|
"DJANGO_ALLOWED_HOSTS",
|
|
"localhost,127.0.0.1,0.0.0.0,chatbackend.aimloperations.com,chat.aimloperations.com",
|
|
)
|
|
ALLOWED_HOSTS = allowed_hosts if allowed_hosts else ["*"]
|
|
|
|
CSRF_TRUSTED_ORIGINS = with_capacitor_webview_origins(
|
|
build_csrf_trusted_origins(
|
|
ALLOWED_HOSTS,
|
|
env_list("DJANGO_CSRF_TRUSTED_ORIGINS"),
|
|
)
|
|
)
|
|
|
|
# JWT Authorization header only — no cookie credentials from the SPA/Capacitor shell.
|
|
CORS_ALLOW_CREDENTIALS = False
|
|
CORS_ORIGIN_ALLOW_ALL = env_bool("CORS_ORIGIN_ALLOW_ALL", True)
|
|
CORS_ALLOWED_ORIGINS = with_capacitor_webview_origins(
|
|
env_list(
|
|
"CORS_ALLOWED_ORIGINS",
|
|
"http://localhost:3000,http://127.0.0.1:3000,https://chat.aimloperations.com",
|
|
)
|
|
)
|
|
|
|
# Ollama — GPU host on LAN for deployed envs; loopback for local Ollama.
|
|
# Prod/beta control-node secret should set OLLAMA_BASE_URL=http://10.0.0.128:11434
|
|
OLLAMA_BASE_URL = (
|
|
env("OLLAMA_BASE_URL", "http://127.0.0.1:11434") or "http://127.0.0.1:11434"
|
|
)
|
|
OLLAMA_MODEL = env(
|
|
"OLLAMA_MODEL",
|
|
"llama3.2" if not DEBUG else "gpt-oss:20b",
|
|
) or ("llama3.2" if not DEBUG else "gpt-oss:20b")
|
|
OLLAMA_EMBED_MODEL = env("OLLAMA_EMBED_MODEL", OLLAMA_MODEL) or OLLAMA_MODEL
|
|
|
|
CHROMA_PERSIST_DIRECTORY = env(
|
|
"CHROMA_PERSIST_DIRECTORY",
|
|
str(BASE_DIR / "chroma_db"),
|
|
) or str(BASE_DIR / "chroma_db")
|
|
|
|
INSTALLED_APPS = [
|
|
"daphne",
|
|
"django.contrib.admin",
|
|
"django.contrib.auth",
|
|
"django.contrib.contenttypes",
|
|
"django.contrib.sessions",
|
|
"django.contrib.messages",
|
|
"whitenoise.runserver_nostatic",
|
|
"django.contrib.staticfiles",
|
|
"chat_backend",
|
|
"finance",
|
|
"rest_framework",
|
|
"corsheaders",
|
|
"rest_framework_simplejwt.token_blacklist",
|
|
]
|
|
|
|
MIDDLEWARE = [
|
|
"django.middleware.security.SecurityMiddleware",
|
|
"whitenoise.middleware.WhiteNoiseMiddleware",
|
|
"django.contrib.sessions.middleware.SessionMiddleware",
|
|
"corsheaders.middleware.CorsMiddleware",
|
|
"django.middleware.common.CommonMiddleware",
|
|
"django.middleware.csrf.CsrfViewMiddleware",
|
|
"django.contrib.auth.middleware.AuthenticationMiddleware",
|
|
"django.contrib.messages.middleware.MessageMiddleware",
|
|
"django.middleware.clickjacking.XFrameOptionsMiddleware",
|
|
]
|
|
|
|
ROOT_URLCONF = "llm_be.urls"
|
|
|
|
TEMPLATES = [
|
|
{
|
|
"BACKEND": "django.template.backends.django.DjangoTemplates",
|
|
"DIRS": [os.path.join(BASE_DIR, "templates")],
|
|
"APP_DIRS": True,
|
|
"OPTIONS": {
|
|
"context_processors": [
|
|
"django.template.context_processors.debug",
|
|
"django.template.context_processors.request",
|
|
"django.contrib.auth.context_processors.auth",
|
|
"django.contrib.messages.context_processors.messages",
|
|
],
|
|
},
|
|
},
|
|
]
|
|
|
|
WSGI_APPLICATION = "llm_be.wsgi.application"
|
|
ASGI_APPLICATION = "llm_be.asgi.application"
|
|
|
|
DATABASES = database_config()
|
|
|
|
AUTH_PASSWORD_VALIDATORS = [
|
|
{
|
|
"NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
|
|
},
|
|
{
|
|
"NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
|
|
},
|
|
{
|
|
"NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
|
|
},
|
|
{
|
|
"NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
|
|
},
|
|
]
|
|
|
|
TEST_RUNNER = "llm_be.test_runner.ChatBackendTestRunner"
|
|
|
|
LANGUAGE_CODE = "en-us"
|
|
TIME_ZONE = "UTC"
|
|
USE_I18N = True
|
|
USE_L10N = True
|
|
USE_TZ = True
|
|
|
|
STATIC_URL = "/static/"
|
|
STATIC_ROOT = BASE_DIR / "staticfiles"
|
|
MEDIA_URL = "/media/"
|
|
MEDIA_ROOT = BASE_DIR / "media"
|
|
|
|
STORAGES = {
|
|
"default": {
|
|
"BACKEND": "chat_backend.storage.DatabaseStorage",
|
|
},
|
|
"staticfiles": {
|
|
"BACKEND": "whitenoise.storage.CompressedManifestStaticFilesStorage",
|
|
},
|
|
}
|
|
|
|
DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
|
|
|
|
AUTH_USER_MODEL = "chat_backend.CustomUser"
|
|
|
|
REST_FRAMEWORK = {
|
|
"DEFAULT_PERMISSION_CLASSES": ("rest_framework.permissions.IsAuthenticated",),
|
|
"DEFAULT_AUTHENTICATION_CLASSES": (
|
|
"rest_framework_simplejwt.authentication.JWTAuthentication",
|
|
),
|
|
}
|
|
|
|
SIMPLE_JWT = {
|
|
"ACCESS_TOKEN_LIFETIME": timedelta(hours=5),
|
|
"REFRESH_TOKEN_LIFETIME": timedelta(days=14),
|
|
"ROTATE_REFRESH_TOKENS": True,
|
|
"BLACKLIST_AFTER_ROTATION": True,
|
|
"ALGORITHM": "HS256",
|
|
"SIGNING_KEY": SECRET_KEY,
|
|
"VERIFYING_KEY": None,
|
|
"AUTH_HEADER_TYPES": ("JWT",),
|
|
"USER_ID_FIELD": "id",
|
|
"USER_ID_CLAIM": "user_id",
|
|
"AUTH_TOKEN_CLASSES": ("rest_framework_simplejwt.tokens.AccessToken",),
|
|
"TOKEN_TYPE_CLAIM": "token_type",
|
|
}
|
|
|
|
CHANNEL_LAYERS = {
|
|
"default": {
|
|
"BACKEND": "channels.layers.InMemoryChannelLayer",
|
|
},
|
|
}
|
|
|
|
EMAIL_HOST = env("EMAIL_HOST", "mail.smtp2go.com") or "mail.smtp2go.com"
|
|
EMAIL_HOST_USER = env("EMAIL_HOST_USER", "") or ""
|
|
EMAIL_HOST_PASSWORD = env("EMAIL_HOST_PASSWORD", "") or ""
|
|
EMAIL_PORT = int(env("EMAIL_PORT", "2525") or "2525")
|
|
EMAIL_USE_TLS = env_bool("EMAIL_USE_TLS", True)
|
|
|
|
# Django 6 Tasks: ImmediateBackend runs in-process (no worker yet). Swap BACKEND
|
|
# to a durable queue + worker when SMTP should leave the request thread.
|
|
TASKS = {
|
|
"default": {
|
|
"BACKEND": "django.tasks.backends.immediate.ImmediateBackend",
|
|
}
|
|
}
|
|
|
|
CAPTCHA_SECRET_KEY = env("CAPTCHA_SECRET_KEY", "") or ""
|
|
|
|
USE_TLS_PROXY = env_bool("USE_TLS_PROXY", DJANGO_ENV in {"prod", "beta"})
|
|
if USE_TLS_PROXY:
|
|
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
|
|
|
|
directory_path = env("DJANGO_LOG_DIR", str(BASE_DIR / "logs")) or str(BASE_DIR / "logs")
|
|
os.makedirs(directory_path, exist_ok=True)
|
|
|
|
ALLOW_IMAGE_GENERATION = env_bool("ALLOW_IMAGE_GENERATION", False)
|
|
ALLOW_INTERNET_ACCESS = env_bool("ALLOW_INTERNET_ACCESS", True)
|
|
|
|
# Self-serve account registration (sign-up page). Default off — enable via
|
|
# control-node secret (chat_backend_<env>.env) when ready for public sign-up.
|
|
ENABLE_ACCOUNT_REGISTRATION = env_bool("ENABLE_ACCOUNT_REGISTRATION", False)
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# OAuth SSO (Google / Microsoft) — #24
|
|
# ---------------------------------------------------------------------------
|
|
GOOGLE_OAUTH_CLIENT_ID = env("GOOGLE_OAUTH_CLIENT_ID", "") or ""
|
|
GOOGLE_OAUTH_CLIENT_SECRET = env("GOOGLE_OAUTH_CLIENT_SECRET", "") or ""
|
|
MICROSOFT_OAUTH_CLIENT_ID = env("MICROSOFT_OAUTH_CLIENT_ID", "") or ""
|
|
MICROSOFT_OAUTH_CLIENT_SECRET = env("MICROSOFT_OAUTH_CLIENT_SECRET", "") or ""
|
|
# Azure AD tenant: "common" (personal + work), "organizations", or a tenant ID.
|
|
MICROSOFT_OAUTH_TENANT = env("MICROSOFT_OAUTH_TENANT", "common") or "common"
|
|
# Public backend origin for IdP redirect URIs (e.g. https://chatbackend.aimloperations.com).
|
|
# When empty, callback URLs are built from the incoming request.
|
|
OAUTH_CALLBACK_BASE_URL = (env("OAUTH_CALLBACK_BASE_URL", "") or "").rstrip("/")
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Finance / Stripe (subscription billing)
|
|
# ---------------------------------------------------------------------------
|
|
STRIPE_SECRET_KEY = env("STRIPE_SECRET_KEY", "") or ""
|
|
STRIPE_PUBLISHABLE_KEY = env("STRIPE_PUBLISHABLE_KEY", "") or ""
|
|
STRIPE_WEBHOOK_SECRET = env("STRIPE_WEBHOOK_SECRET", "") or ""
|
|
# Optional: use a pre-created Stripe Price. When empty, Checkout uses
|
|
# price_data built from SUBSCRIPTION_PRICE_* below.
|
|
STRIPE_PRICE_ID = env("STRIPE_PRICE_ID", "") or ""
|
|
|
|
# Subscription list price — $10.00 USD / month (amount in cents).
|
|
SUBSCRIPTION_PRICE_AMOUNT_CENTS = int(
|
|
env("SUBSCRIPTION_PRICE_AMOUNT_CENTS", "1000") or "1000"
|
|
)
|
|
SUBSCRIPTION_PRICE_CURRENCY = (
|
|
env("SUBSCRIPTION_PRICE_CURRENCY", "usd") or "usd"
|
|
).lower()
|
|
SUBSCRIPTION_PRICE_INTERVAL = (
|
|
env("SUBSCRIPTION_PRICE_INTERVAL", "month") or "month"
|
|
).lower()
|
|
SUBSCRIPTION_PRODUCT_NAME = (
|
|
env("SUBSCRIPTION_PRODUCT_NAME", "Chat Subscription") or "Chat Subscription"
|
|
)
|
|
|
|
FRONTEND_BASE_URL = (
|
|
env("FRONTEND_BASE_URL", "http://localhost:3000") or "http://localhost:3000"
|
|
).rstrip("/")
|
|
STRIPE_CHECKOUT_SUCCESS_URL = env(
|
|
"STRIPE_CHECKOUT_SUCCESS_URL",
|
|
f"{FRONTEND_BASE_URL}/billing/success?session_id={{CHECKOUT_SESSION_ID}}",
|
|
) or f"{FRONTEND_BASE_URL}/billing/success?session_id={{CHECKOUT_SESSION_ID}}"
|
|
STRIPE_CHECKOUT_CANCEL_URL = env(
|
|
"STRIPE_CHECKOUT_CANCEL_URL",
|
|
f"{FRONTEND_BASE_URL}/billing/cancel",
|
|
) or f"{FRONTEND_BASE_URL}/billing/cancel"
|
|
|
|
if DJANGO_ENV in {"prod", "beta"}:
|
|
# Compose treats $ in .env as variable expansion — escape each $ as $$.
|
|
if not SECRET_KEY:
|
|
raise ValueError(
|
|
"DJANGO_SECRET_KEY is empty in prod/beta. Set it in the control-node "
|
|
"secret (~/Documents/secrets/chat_backend/chat_backend_<env>.env). "
|
|
"If the value contains $, write $$ or Compose will strip/empty it."
|
|
)
|
|
if SECRET_KEY.startswith("django-insecure") or "dev-only" in SECRET_KEY:
|
|
raise ValueError(
|
|
"DJANGO_SECRET_KEY still looks like a placeholder "
|
|
"(starts with 'django-insecure' or contains 'dev-only'). "
|
|
"Replace it with a real random secret and redeploy."
|
|
)
|