98059a8a70
- Cont demo (demo@example.com/demo1234) activ implicit, identificat prin settings.demo_email — fără configurare în env; DEMO_EMAIL="" îl dezactivează - Contul demo nu poate fi modificat prin API (email/parolă/status blocate 403) - reset_demo.py: șterge idempotent toate datele demo și recrează proprietatea demo cu 3 spații și 5 rezervări exemplu cu date relative la ziua curentă - entrypoint.sh: reset la boot + buclă la 3h (DEMO_RESET_INTERVAL) - start.sh (dev): reset la fiecare pornire - Login.vue: hint cu credențialele demo (click = precompletare) și mesajul de resetare la 3 ore Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
80 lines
2.5 KiB
Python
80 lines
2.5 KiB
Python
"""Application configuration."""
|
|
from typing import List
|
|
from pydantic import model_validator
|
|
from pydantic_settings import BaseSettings, SettingsConfigDict
|
|
|
|
DEFAULT_SECRET_KEY = "your-secret-key-change-in-production"
|
|
|
|
# Known weak/placeholder secrets that must never reach production.
|
|
WEAK_SECRET_KEYS = {
|
|
DEFAULT_SECRET_KEY,
|
|
"change-me-in-production", # docker-compose fallback
|
|
"change-me",
|
|
"secret",
|
|
"changeme",
|
|
}
|
|
|
|
|
|
class Settings(BaseSettings):
|
|
"""Application settings."""
|
|
|
|
model_config = SettingsConfigDict(
|
|
env_file=".env",
|
|
env_file_encoding="utf-8",
|
|
case_sensitive=False
|
|
)
|
|
|
|
# App
|
|
app_name: str = "Space Booking API"
|
|
debug: bool = False
|
|
|
|
# Database
|
|
database_url: str = "sqlite:///./space_booking.db"
|
|
|
|
# JWT
|
|
secret_key: str = DEFAULT_SECRET_KEY
|
|
algorithm: str = "HS256"
|
|
access_token_expire_minutes: int = 1440 # 24 hours
|
|
|
|
# SMTP
|
|
smtp_host: str = "localhost"
|
|
smtp_port: int = 1025 # MailHog default
|
|
smtp_user: str = ""
|
|
smtp_password: str = ""
|
|
smtp_from_address: str = "noreply@space-booking.local"
|
|
smtp_enabled: bool = False # Disable by default for dev
|
|
|
|
# Frontend
|
|
frontend_url: str = "http://localhost:5173"
|
|
|
|
# Demo account (public playground), enabled by default. The account
|
|
# cannot be modified through the API and its data is recreated by
|
|
# reset_demo.py (scheduled from entrypoint.sh, every 3 hours).
|
|
# Set DEMO_EMAIL="" in the environment to disable the feature.
|
|
demo_email: str = "demo@example.com"
|
|
demo_password: str = "demo1234"
|
|
|
|
# Google Calendar OAuth
|
|
google_client_id: str = ""
|
|
google_client_secret: str = ""
|
|
google_redirect_uri: str = "http://localhost:8000/api/integrations/google/callback"
|
|
google_scopes: List[str] = [
|
|
"https://www.googleapis.com/auth/calendar",
|
|
"https://www.googleapis.com/auth/calendar.events"
|
|
]
|
|
|
|
@model_validator(mode="after")
|
|
def _enforce_production_secrets(self) -> "Settings":
|
|
"""Refuse to boot in production with a weak SECRET_KEY."""
|
|
if not self.debug:
|
|
if self.secret_key in WEAK_SECRET_KEYS or len(self.secret_key) < 32:
|
|
raise ValueError(
|
|
"SECRET_KEY is weak or a placeholder. Set a strong, random value "
|
|
"(>= 32 chars) before running in production (DEBUG=false). "
|
|
"Generate one with: python -c \"import secrets; print(secrets.token_hex(32))\""
|
|
)
|
|
return self
|
|
|
|
|
|
settings = Settings()
|