0a9a83507e
- Fix task status IDOR by adding ownership check; suppress traceback/error in production - Passkey routes: return generic error messages for internal exceptions, keep ValueError for user-facing - JWT_SECRET and OIDC_CLIENT_ID: raise RuntimeError in production when using defaults - Rate limiter: add in-memory fallback counter when Redis is unavailable - Fix X-Forwarded-For IP spoofing with trusted_proxy_depth (rightmost-N selection) - Add SecurityHeadersMiddleware (X-Content-Type-Options, X-Frame-Options, CSP, conditional HSTS) - CORS: add PUT/DELETE methods for POI routes - POI input validation: field length and coordinate range constraints - QueryParameters: add min_sqm <= max_sqm validation
41 lines
1.6 KiB
Python
41 lines
1.6 KiB
Python
from datetime import timedelta
|
|
import logging
|
|
import os
|
|
|
|
|
|
_logger = logging.getLogger(__name__)
|
|
|
|
APP_ENV = os.getenv("APP_ENV", "development")
|
|
|
|
# Authentik OIDC Configuration
|
|
AUTHENTIK_URL = os.getenv("AUTHENTIK_URL", "https://authentik.viktorbarzin.me")
|
|
OIDC_CLIENT_ID = os.getenv("OIDC_CLIENT_ID", "")
|
|
if APP_ENV == "production" and not OIDC_CLIENT_ID:
|
|
raise RuntimeError("OIDC_CLIENT_ID must be set in production")
|
|
if not OIDC_CLIENT_ID:
|
|
_logger.warning("OIDC_CLIENT_ID not set; OIDC login will not work")
|
|
OIDC_METADATA_URL = (
|
|
f"{AUTHENTIK_URL}/application/o/wrongmove/.well-known/openid-configuration"
|
|
)
|
|
|
|
OIDC_CACHE_TTL = timedelta(
|
|
hours=1
|
|
).total_seconds() # Cache to avoid spamming authentik with requests
|
|
|
|
DEV_TIER_ORIGINS = ["https://localhost/"]
|
|
PROD_TIER_ORIGINS = ["https://wrongmove.viktorbarzin.me/"]
|
|
|
|
# WebAuthn / Passkey Configuration
|
|
WEBAUTHN_RP_ID = os.getenv("WEBAUTHN_RP_ID", "localhost")
|
|
WEBAUTHN_RP_NAME = os.getenv("WEBAUTHN_RP_NAME", "Wrongmove")
|
|
WEBAUTHN_ORIGIN = os.getenv("WEBAUTHN_ORIGIN", "https://localhost")
|
|
|
|
# JWT Configuration (for passkey-issued tokens)
|
|
JWT_SECRET = os.getenv("JWT_SECRET", "change-me-in-production")
|
|
if JWT_SECRET == "change-me-in-production":
|
|
if APP_ENV == "production":
|
|
raise RuntimeError("JWT_SECRET must be changed from default in production")
|
|
_logger.warning("JWT_SECRET is using the default value. Set JWT_SECRET env var in production.")
|
|
JWT_ALGORITHM = os.getenv("JWT_ALGORITHM", "HS256")
|
|
JWT_EXPIRATION_HOURS = int(os.getenv("JWT_EXPIRATION_HOURS", "24"))
|
|
JWT_ISSUER = os.getenv("JWT_ISSUER", "wrongmove")
|