""" Django settings for mysite project. Generated by 'django-admin startproject' using Django 6.0. For more information on this file, see https://docs.djangoproject.com/en/6.0/topics/settings/ For the full list of settings and their values, see https://docs.djangoproject.com/en/6.0/ref/settings/ """ from pathlib import Path #from django.db.backends.postgresql.psycopg_any import IsolationLevel from datetime import timedelta from dotenv import load_dotenv import os # Aqui se cargan las variables de entorno del api load_dotenv() # Build paths inside the project like this: BASE_DIR / 'subdir'. BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__))) # Quick-start development settings - unsuitable for production # See https://docs.djangoproject.com/en/6.0/howto/deployment/checklist/ # SECURITY WARNING: keep the secret key used in production secret! # En el servidor definir SECRET_KEY por variable de entorno: firma los JWT y la clave del código está en el repositorio SECRET_KEY = os.environ.get('SECRET_KEY', 'django-insecure--jc0^^b*j1k=4n38its9)q_5%2m&c)!$-7b$@w_h7=5#bi@&jp') # SECURITY WARNING: don't run with debug turned on in production! DEBUG = os.environ.get('DEBUG', 'True') == 'True' ALLOWED_HOSTS = [ 'api-sphere-308601230968.us-central1.run.app', 'localhost', 'api-sphere.onrender.com', 'api.sportspherecenter.com' ] # Application definitions INSTALLED_APPS = [ 'django.contrib.admin', 'django.contrib.auth', 'django.contrib.contenttypes', 'django.contrib.sessions', 'django.contrib.messages', 'django.contrib.staticfiles', 'rest_framework', 'rest_framework.authtoken', 'rest_framework_simplejwt.token_blacklist', 'drf_yasg', 'corsheaders', 'usuarios', 'apitransbank', 'finanzas', 'reportes', 'sendMail', 'equipos', 'eventos', 'avisos', 'notifications' ] REST_FRAMEWORK = { 'DEFAULT_AUTHENTICATION_CLASSES': [ 'rest_framework_simplejwt.authentication.JWTAuthentication' ], 'DEFAULT_PERMISSION_CLASSES': [ 'rest_framework.permissions.IsAuthenticated', # Protege por defecto las vistas ], } AUTH_USER_MODEL = 'usuarios.Usuarios' AUTHENTICATION_BACKENDS = [ 'usuarios.auth_backend.CustomAuthBackend', ] MIDDLEWARE = [ 'django.middleware.security.SecurityMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'corsheaders.middleware.CorsMiddleware', 'django.middleware.common.CommonMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', 'whitenoise.middleware.WhiteNoiseMiddleware', 'usuarios.middleware.JWTAuthCookieMiddleware' ] # Configuración adicional para WhiteNoise STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage' ROOT_URLCONF = 'mysite.urls' TEMPLATES = [ { 'BACKEND': 'django.template.backends.django.DjangoTemplates', 'DIRS': [], 'APP_DIRS': True, 'OPTIONS': { 'context_processors': [ 'django.template.context_processors.request', 'django.contrib.auth.context_processors.auth', 'django.contrib.messages.context_processors.messages', ], }, }, ] WSGI_APPLICATION = 'mysite.wsgi.application' # Database # https://docs.djangoproject.com/en/6.0/ref/settings/#databases DATABASES = { 'default': { 'ENGINE': os.environ.get('DB_ENGINE'), 'NAME': os.environ.get('DB_NAME'), 'USER': os.environ.get('DB_USER'), 'PASSWORD': os.environ.get('DB_PASS'), 'HOST': os.environ.get('DB_HOST'), 'PORT': os.environ.get('DB_PORT') } } # Valores por defecto recomendados JWT_COOKIE_SECURE = True # True en prod (HTTPS), False en dev JWT_COOKIE_SAMESITE = "None" if DEBUG else "None" # "None" si front y API son cross-site en prod JWT_COOKIE_DOMAIN = None # Normalmente None; ver notas de dominio más abajo # IAM (tinyauth vía BFF): el login solo recibe el usuario y se valida contra la sesión del IAM. # Requiere que la cookie de sesión del BFF esté en el dominio padre (.sportspherecenter.com) para llegar a la API. IAM_VERIFY_LOGIN = os.environ.get('IAM_VERIFY_LOGIN', 'True') == 'True' IAM_ME_URL = os.environ.get('IAM_ME_URL', 'https://bff-auth.sportspherecenter.com/auth/me') IAM_TIMEOUT_SECONDS = 5 # Solo desarrollo: permite el login sin IAM cuando la API se usa desde localhost. # Activar únicamente en el .env local (IAM_LOCAL_BYPASS=True); nunca en el servidor. IAM_LOCAL_BYPASS = os.environ.get('IAM_LOCAL_BYPASS', 'False') == 'True' IAM_LOCAL_BYPASS_HOSTS = ('localhost', '127.0.0.1') # Correo (Mailjet). Las credenciales van en variables de entorno, nunca en el código. MAILJET_API_KEY = os.environ.get('MAILJET_API_KEY') MAILJET_API_SECRET = os.environ.get('MAILJET_API_SECRET') MAIL_FROM_EMAIL = os.environ.get('MAIL_FROM_EMAIL', 'ni.catalmir@gmail.com') # Destinatario de los mensajes del formulario de contacto CONTACT_EMAIL_TO = os.environ.get('CONTACT_EMAIL_TO', MAIL_FROM_EMAIL) CONTACT_UPAC_EMAIL_TO = os.environ.get('CONTACT_UPAC_EMAIL_TO') # Password validation # https://docs.djangoproject.com/en/6.0/ref/settings/#auth-password-validators AUTH_PASSWORD_VALIDATORS = [ { 'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator', }, { 'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator', }, { 'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator', }, { 'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator', }, ] # Internationalization # https://docs.djangoproject.com/en/6.0/topics/i18n/ LANGUAGE_CODE = 'en-us' TIME_ZONE = 'UTC' USE_I18N = True USE_TZ = True # Static files (CSS, JavaScript, Images) # https://docs.djangoproject.com/en/6.0/howto/static-files/ STATIC_URL = 'static/' STATIC_ROOT = os.path.join(BASE_DIR, 'static/') SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https') SIMPLE_JWT_SHORT = { 'ACCESS_TOKEN_LIFETIME': timedelta(minutes=15), # Token corto 'REFRESH_TOKEN_LIFETIME': timedelta(days=1), # 1 día 'ROTATE_REFRESH_TOKENS': True, # Genera nuevos tokens de refresco al usarlos 'BLACKLIST_AFTER_ROTATION': True, 'AUTH_HEADER_TYPES': ('Bearer',), 'AUTH_HEADER_NAME': 'HTTP_AUTHORIZATION', 'USER_ID_FIELD': 'id', 'USER_ID_CLAIM': 'user_id', # Configuración de cookies 'AUTH_COOKIE': 'access_token', 'AUTH_COOKIE_REFRESH': 'refresh_token', 'AUTH_COOKIE_SECURE': True, # False en desarrollo, True en producción 'AUTH_COOKIE_HTTP_ONLY': True, 'AUTH_COOKIE_PATH': '/', 'AUTH_COOKIE_SAMESITE': 'None', } # Configuración con "Recuérdame" SIMPLE_JWT_LONG = { 'ACCESS_TOKEN_LIFETIME': timedelta(days=1), # Token más largo 'REFRESH_TOKEN_LIFETIME': timedelta(days=30), # 30 días 'ROTATE_REFRESH_TOKENS': True, 'BLACKLIST_AFTER_ROTATION': True, 'AUTH_HEADER_TYPES': ('Bearer',), 'AUTH_HEADER_NAME': 'HTTP_AUTHORIZATION', 'USER_ID_FIELD': 'id', 'USER_ID_CLAIM': 'user_id', # Cookies 'AUTH_COOKIE': 'access_token', 'AUTH_COOKIE_REFRESH': 'refresh_token', 'AUTH_COOKIE_SECURE': True, 'AUTH_COOKIE_HTTP_ONLY': True, 'AUTH_COOKIE_PATH': '/', 'AUTH_COOKIE_SAMESITE': 'None', } SIMPLE_JWT = SIMPLE_JWT_SHORT. copy() SWAGGER_SETTINGS = { 'SECURITY_DEFINITIONS': { 'Bearer': { 'type': 'apiKey', 'name': 'Authorization', 'in': 'header' } }, 'USE_SESSION_AUTH': False, } CORS_ALLOWED_ORIGINS = [ "http://localhost:3000", # React development server "http://localhost:8080", # Vue development server "http://localhost:4200", # Angular development server "http://localhost:8082", # Angular development server sw "https://sphere-481401.web.app", "https://sphere-481401.firebaseapp.com", "https://api-sphere.onrender.com", "https://api.sportspherecenter.com", "https://dev.sportspherecenter.com" ] CORS_ALLOW_CREDENTIALS = True CORS_ALLOW_METHODS = [ 'DELETE', 'GET', 'OPTIONS', 'PATCH', 'POST', 'PUT', ] CORS_ALLOW_HEADERS = [ 'accept', 'accept-encoding', 'authorization', 'content-type', 'dnt', 'origin', 'user-agent', 'x-csrftoken', 'x-requested-with', ] WEBPUSH_VAPID_PUBLIC_KEY="BPUz4LbqWQ37yEGwuCBW-pPzYfBwFzgi0H0xT9pvmV2d0BZaBKZi2UhdfXiEno-Q2OTKRPMm9JWjCRzF90hE8M8" WEBPUSH_VAPID_PRIVATE_KEY="LOmwxfnxRxMobwrCqIOuf6tZYB6HfA0srmBTN0tQkCk" WEBPUSH_VAPID_SUBJECT="mailto:admin@tu-dominio.com"