""" Django settings for ai_web project. """ import os from decimal import Decimal from pathlib import Path from datetime import timedelta from dotenv import load_dotenv # Load environment variables load_dotenv() # Environment helpers def _env_bool(key: str, default: bool = False) -> bool: value = os.getenv(key, str(default)) return str(value).strip().lower() in {"1", "true", "yes", "y", "on"} def _env_csv(key: str, default: str) -> list[str]: raw = os.getenv(key) if raw is None: raw = default return [item.strip() for item in raw.split(",") if item.strip()] # Build paths inside the project like this: BASE_DIR / 'subdir'. BASE_DIR = Path(__file__).resolve().parent.parent # SECURITY WARNING: keep the secret key used in production secret! DEBUG = _env_bool("DEBUG", False) SECRET_KEY = os.getenv("DJANGO_SECRET_KEY") if not SECRET_KEY: if DEBUG: SECRET_KEY = "django-insecure-dev-key" else: raise RuntimeError("DJANGO_SECRET_KEY is required in production") ALLOWED_HOSTS = _env_csv("ALLOWED_HOSTS", "localhost,127.0.0.1" if DEBUG else "") if not DEBUG and not ALLOWED_HOSTS: raise RuntimeError("ALLOWED_HOSTS must be configured in production") # Application definition INSTALLED_APPS = [ 'django.contrib.admin', 'django.contrib.auth', 'django.contrib.contenttypes', 'django.contrib.sessions', 'django.contrib.messages', 'django.contrib.staticfiles', # Third party 'corsheaders', 'ninja_jwt', # Local apps 'apps.users', 'apps.products', 'apps.bounties', 'apps.favorites', 'apps.notifications', 'apps.admin.apps.AdminApiConfig', ] MIDDLEWARE = [ 'corsheaders.middleware.CorsMiddleware', 'django.middleware.security.SecurityMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.common.CommonMiddleware', 'config.middleware.RateLimitMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'config.middleware.ETagMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', ] ROOT_URLCONF = 'config.urls' TEMPLATES = [ { 'BACKEND': 'django.template.backends.django.DjangoTemplates', 'DIRS': [], 'APP_DIRS': True, 'OPTIONS': { 'context_processors': [ 'django.template.context_processors.debug', 'django.template.context_processors.request', 'django.contrib.auth.context_processors.auth', 'django.contrib.messages.context_processors.messages', ], }, }, ] WSGI_APPLICATION = 'config.wsgi.application' # Database DB_ENGINE = os.getenv("DB_ENGINE", "sqlite").lower() if DB_ENGINE == "mysql": DATABASES = { "default": { "ENGINE": "django.db.backends.mysql", "NAME": os.getenv("DB_NAME", "ai_web"), "USER": os.getenv("DB_USER", "root"), "PASSWORD": os.getenv("DB_PASSWORD", ""), "HOST": os.getenv("DB_HOST", "localhost"), "PORT": os.getenv("DB_PORT", "3306"), "OPTIONS": { "charset": "utf8mb4", }, } } else: DATABASES = { "default": { "ENGINE": "django.db.backends.sqlite3", "NAME": BASE_DIR / "db.sqlite3", } } # Password validation AUTH_PASSWORD_VALIDATORS = [ { 'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator', }, { 'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator', }, { 'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator', }, { 'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator', }, ] # Internationalization LANGUAGE_CODE = 'zh-hans' TIME_ZONE = 'Asia/Shanghai' USE_I18N = True USE_TZ = True # Static files (CSS, JavaScript, Images) STATIC_URL = 'static/' STATIC_ROOT = BASE_DIR / 'staticfiles' # Default primary key field type DEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField' # Custom user model AUTH_USER_MODEL = 'users.User' # CORS settings CORS_ALLOWED_ORIGINS = _env_csv( "CORS_ALLOWED_ORIGINS", "http://localhost:5173,http://127.0.0.1:5173" if DEBUG else "", ) if not DEBUG and not CORS_ALLOWED_ORIGINS: raise RuntimeError("CORS_ALLOWED_ORIGINS must be configured in production") CORS_ALLOW_CREDENTIALS = True CSRF_TRUSTED_ORIGINS = _env_csv( "CSRF_TRUSTED_ORIGINS", "http://localhost:5173,http://127.0.0.1:5173" if DEBUG else "", ) # JWT settings NINJA_JWT = { 'ACCESS_TOKEN_LIFETIME': timedelta(hours=24), 'REFRESH_TOKEN_LIFETIME': timedelta(days=7), 'ALGORITHM': 'HS256', 'SIGNING_KEY': SECRET_KEY, 'AUTH_HEADER_TYPES': ('Bearer',), 'AUTH_COOKIE': 'access_token', 'AUTH_COOKIE_HTTP_ONLY': True, 'AUTH_COOKIE_SECURE': not DEBUG, 'AUTH_COOKIE_SAMESITE': 'Lax', } # Cache settings CACHES = { "default": { "BACKEND": "django.core.cache.backends.locmem.LocMemCache", "LOCATION": "ai_web_cache", "TIMEOUT": int(os.getenv("CACHE_DEFAULT_TIMEOUT", "300")), } } CACHE_TTL_SECONDS = int(os.getenv("CACHE_TTL_SECONDS", "60")) ETAG_MAX_BYTES = int(os.getenv("ETAG_MAX_BYTES", str(2 * 1024 * 1024))) # Security settings for production if not DEBUG: SECURE_SSL_REDIRECT = _env_bool("SECURE_SSL_REDIRECT", True) SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https") SESSION_COOKIE_SECURE = True CSRF_COOKIE_SECURE = True SESSION_COOKIE_SAMESITE = "Lax" CSRF_COOKIE_SAMESITE = "Lax" SECURE_HSTS_SECONDS = int(os.getenv("SECURE_HSTS_SECONDS", "31536000")) SECURE_HSTS_INCLUDE_SUBDOMAINS = _env_bool("SECURE_HSTS_INCLUDE_SUBDOMAINS", True) SECURE_HSTS_PRELOAD = _env_bool("SECURE_HSTS_PRELOAD", True) SECURE_REFERRER_POLICY = os.getenv("SECURE_REFERRER_POLICY", "same-origin") # Stripe settings STRIPE_SECRET_KEY = os.getenv('STRIPE_SECRET_KEY', '') STRIPE_WEBHOOK_SECRET = os.getenv('STRIPE_WEBHOOK_SECRET', '') STRIPE_PUBLISHABLE_KEY = os.getenv('STRIPE_PUBLISHABLE_KEY', '') # Bounty settings BOUNTY_MIN_REWARD = Decimal(os.getenv("BOUNTY_MIN_REWARD", "0.01")) BOUNTY_MAX_REWARD = Decimal(os.getenv("BOUNTY_MAX_REWARD", "99999999.99")) BOUNTY_PLATFORM_FEE_PERCENT = Decimal(os.getenv("BOUNTY_PLATFORM_FEE_PERCENT", "0.05")) # OAuth settings (Manus SDK compatible) OAUTH_CLIENT_ID = os.getenv("OAUTH_CLIENT_ID", "") OAUTH_CLIENT_SECRET = os.getenv("OAUTH_CLIENT_SECRET", "") OAUTH_REDIRECT_URI = os.getenv("OAUTH_REDIRECT_URI", "http://localhost:8000/api/auth/callback") OAUTH_AUTHORIZE_URL = os.getenv("OAUTH_AUTHORIZE_URL", "") OAUTH_TOKEN_URL = os.getenv("OAUTH_TOKEN_URL", "") OAUTH_USERINFO_URL = os.getenv("OAUTH_USERINFO_URL", "") # Basic rate limiting RATE_LIMIT_ENABLE = _env_bool("RATE_LIMIT_ENABLE", not DEBUG) RATE_LIMIT_REQUESTS = int(os.getenv("RATE_LIMIT_REQUESTS", "120")) RATE_LIMIT_WINDOW_SECONDS = int(os.getenv("RATE_LIMIT_WINDOW_SECONDS", "60")) RATE_LIMIT_PATHS = _env_csv("RATE_LIMIT_PATHS", "/api/")