""" Configuración base de Django — Catálogo Web Dra. Mariela Moreno Autie ===================================================================== Configuración compartida entre todos los entornos. Las credenciales se leen de .env mediante python-decouple. """ import os from pathlib import Path from decouple import Csv, config # ============================================================ # PATHS # ============================================================ BASE_DIR = Path(__file__).resolve().parent.parent.parent PROJECT_DIR = BASE_DIR.parent # ============================================================ # SEGURIDAD # ============================================================ SECRET_KEY = config("SECRET_KEY") ALLOWED_HOSTS = config("ALLOWED_HOSTS", default="localhost", cast=Csv()) SITE_URL = config("SITE_URL", default="http://localhost:8000") # --- Headers de Seguridad (OWASP A05) --- SECURE_CONTENT_TYPE_NOSNIFF = True X_FRAME_OPTIONS = "DENY" SECURE_REFERRER_POLICY = "strict-origin-when-cross-origin" # --- Cookies y Sesiones (OWASP A07) --- SESSION_COOKIE_HTTPONLY = True SESSION_COOKIE_SAMESITE = "Lax" SESSION_COOKIE_AGE = 3600 # 1 hora SESSION_EXPIRE_AT_BROWSER_CLOSE = True CSRF_COOKIE_HTTPONLY = True CSRF_COOKIE_SAMESITE = "Lax" # ============================================================ # APLICACIONES # ============================================================ DJANGO_APPS = [ "django.contrib.admin", "django.contrib.auth", "django.contrib.contenttypes", "django.contrib.sessions", "django.contrib.messages", "django.contrib.staticfiles", ] THIRD_PARTY_APPS = [ "rest_framework", "rest_framework_simplejwt", "rest_framework_simplejwt.token_blacklist", "corsheaders", "django_filters", "django_extensions", "django_celery_beat", "django_celery_results", "django_cleanup.apps.CleanupConfig", "drf_spectacular", ] LOCAL_APPS = [ "apps.core.apps.CoreConfig", "apps.users.apps.UsersConfig", "apps.appointments.apps.AppointmentsConfig", "apps.finance.apps.FinanceConfig", "apps.especialidades.apps.EspecialidadesConfig", "apps.reports.apps.ReportsConfig", "apps.notifications.apps.NotificationsConfig", "apps.dashboard.apps.DashboardConfig", "apps.ratings.apps.RatingsConfig", "apps.api.apps.ApiConfig", ] INSTALLED_APPS = DJANGO_APPS + THIRD_PARTY_APPS + LOCAL_APPS # ============================================================ # MIDDLEWARE # ============================================================ MIDDLEWARE = [ "django.middleware.security.SecurityMiddleware", "whitenoise.middleware.WhiteNoiseMiddleware", "django.contrib.sessions.middleware.SessionMiddleware", "corsheaders.middleware.CorsMiddleware", "django.middleware.common.CommonMiddleware", "django.middleware.csrf.CsrfViewMiddleware", "django.contrib.auth.middleware.AuthenticationMiddleware", "apps.core.middleware.AccountLockoutMiddleware", "django.contrib.messages.middleware.MessageMiddleware", "django.middleware.clickjacking.XFrameOptionsMiddleware", "csp.middleware.CSPMiddleware", ] # ============================================================ # URLS & WSGI # ============================================================ ROOT_URLCONF = "config.urls" WSGI_APPLICATION = "config.wsgi.application" ASGI_APPLICATION = "config.asgi.application" # ============================================================ # TEMPLATES # ============================================================ TEMPLATES = [ { "BACKEND": "django.template.backends.django.DjangoTemplates", "DIRS": [BASE_DIR / "templates"], "APP_DIRS": True, "OPTIONS": { "context_processors": [ "django.template.context_processors.debug", "django.template.context_processors.request", "django.contrib.auth.context_processors.auth", "django.contrib.messages.context_processors.messages", "apps.appointments.context_processors.citas_pendientes_count", "apps.core.context_processors.site_config", ], }, }, ] # ============================================================ # BASE DE DATOS — MariaDB # ============================================================ _db_password = config("DB_PASSWORD", default="") DATABASES = { "default": { "ENGINE": config("DB_ENGINE", default="django.db.backends.mysql"), "NAME": config("DB_NAME", default="catalogo_mariela"), "USER": config("DB_USER", default="root"), "HOST": config("DB_HOST", default="localhost"), "PORT": config("DB_PORT", default="3306"), "OPTIONS": { "charset": "utf8mb4", "init_command": "SET sql_mode='STRICT_TRANS_TABLES'", }, } } if _db_password: DATABASES["default"]["PASSWORD"] = _db_password # ============================================================ # CACHÉ — Redis # ============================================================ CACHES = { "default": { "BACKEND": "django_redis.cache.RedisCache", "LOCATION": config("REDIS_URL", default="redis://redis:6379/0"), "OPTIONS": { "CLIENT_CLASS": "django_redis.client.DefaultClient", }, } } SESSION_ENGINE = "django.contrib.sessions.backends.cached_db" SESSION_CACHE_ALIAS = "default" # ============================================================ # PASSWORD HASHERS — Argon2 como principal (OWASP A02) # ============================================================ PASSWORD_HASHERS = [ "django.contrib.auth.hashers.Argon2PasswordHasher", "django.contrib.auth.hashers.PBKDF2PasswordHasher", "django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher", "django.contrib.auth.hashers.BCryptSHA256PasswordHasher", "django.contrib.auth.hashers.ScryptPasswordHasher", ] PASSWORD_RESET_TIMEOUT = 3600 # 1 hora # ============================================================ # VALIDACIÓN DE CONTRASEÑAS (OWASP A07) # ============================================================ AUTH_PASSWORD_VALIDATORS = [ {"NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator"}, {"NAME": "django.contrib.auth.password_validation.MinimumLengthValidator", "OPTIONS": {"min_length": 8}}, {"NAME": "django.contrib.auth.password_validation.CommonPasswordValidator"}, {"NAME": "django.contrib.auth.password_validation.NumericPasswordValidator"}, ] # ============================================================ # BLOQUEO DE CUENTA — Configuración # ============================================================ ACCOUNT_LOGIN_MAX_ATTEMPTS = config("ACCOUNT_LOGIN_MAX_ATTEMPTS", default=5, cast=int) ACCOUNT_LOGIN_LOCKOUT_MINUTES = config("ACCOUNT_LOGIN_LOCKOUT_MINUTES", default=30, cast=int) # ============================================================ # CITAS — Configuracion del modulo de citas # ============================================================ CITA_CANCELACION_HORAS = config("CITA_CANCELACION_HORAS", default=24, cast=int) # ============================================================ # AUTHENTICATION BACKENDS — Con bloqueo de cuenta (OWASP A07) # ============================================================ AUTHENTICATION_BACKENDS = [ "apps.core.backends.SecureModelBackend", ] # ============================================================ # INTERNACIONALIZACIÓN # ============================================================ LANGUAGE_CODE = config("LANGUAGE_CODE", default="pt-ao") TIME_ZONE = config("TIME_ZONE", default="Africa/Luanda") USE_I18N = True USE_TZ = True # ============================================================ # ARCHIVOS ESTÁTICOS Y MEDIA # ============================================================ STATIC_URL = "/static/" STATIC_ROOT = BASE_DIR / "staticfiles" STATICFILES_DIRS = [BASE_DIR / "static"] STATICFILES_STORAGE = "whitenoise.storage.CompressedManifestStaticFilesStorage" MEDIA_URL = "/media/" MEDIA_ROOT = BASE_DIR / "media" # ============================================================ # MODELO DE USUARIO PERSONALIZADO # ============================================================ AUTH_USER_MODEL = "users.CustomUser" LOGIN_URL = "/cuenta/login/" LOGIN_REDIRECT_URL = "/cuenta/login/" LOGOUT_REDIRECT_URL = "/" # ============================================================ # EMAIL — Configuración base (override en dev/prod) # ============================================================ DEFAULT_FROM_EMAIL = config("DEFAULT_FROM_EMAIL", default="noreply@dramerielamoreno.ao") # ============================================================ # REST FRAMEWORK # ============================================================ REST_FRAMEWORK = { "DEFAULT_AUTHENTICATION_CLASSES": [ "rest_framework_simplejwt.authentication.JWTAuthentication", "rest_framework.authentication.SessionAuthentication", ], "DEFAULT_PERMISSION_CLASSES": [ "rest_framework.permissions.IsAuthenticated", ], "DEFAULT_FILTER_BACKENDS": [ "django_filters.rest_framework.DjangoFilterBackend", "rest_framework.filters.SearchFilter", "rest_framework.filters.OrderingFilter", ], "DEFAULT_PAGINATION_CLASS": "rest_framework.pagination.PageNumberPagination", "PAGE_SIZE": 20, "DEFAULT_RENDERER_CLASSES": [ "rest_framework.renderers.JSONRenderer", "rest_framework.renderers.BrowsableAPIRenderer", ], "DEFAULT_SCHEMA_CLASS": "drf_spectacular.openapi.AutoSchema", "DEFAULT_THROTTLE_CLASSES": [ "rest_framework.throttling.AnonRateThrottle", "rest_framework.throttling.UserRateThrottle", ], "DEFAULT_THROTTLE_RATES": { "anon": "30/minute", "user": "120/minute", }, } # ============================================================ # JWT — Simple JWT (OWASP A02/A07) # ============================================================ from datetime import timedelta as _td # noqa: E402 SIMPLE_JWT = { "ACCESS_TOKEN_LIFETIME": _td(minutes=15), "REFRESH_TOKEN_LIFETIME": _td(days=1), "ROTATE_REFRESH_TOKENS": True, "BLACKLIST_AFTER_ROTATION": True, "AUTH_HEADER_TYPES": ("Bearer",), "USER_ID_FIELD": "id", "USER_ID_CLAIM": "user_id", } # ============================================================ # DRF-SPECTACULAR — Swagger / OpenAPI 3 # ============================================================ SPECTACULAR_SETTINGS = { "TITLE": "Dra. Mariela Moreno Autie — API REST", "DESCRIPTION": "API REST del catálogo web de ginecología — Luanda, Angola.", "VERSION": "1.0.0", "SERVE_INCLUDE_SCHEMA": False, "COMPONENT_SPLIT_REQUEST": True, "TAGS": [ {"name": "Auth", "description": "Autenticación JWT"}, {"name": "Perfil", "description": "Perfil de usuario"}, {"name": "Servicios", "description": "Servicios médicos"}, {"name": "Citas", "description": "Gestión de citas"}, {"name": "Horarios", "description": "Horarios de la doctora"}, {"name": "Valoraciones", "description": "Reseñas de pacientes"}, {"name": "Finanzas", "description": "Facturas y pagos"}, {"name": "Notificaciones", "description": "Logs WhatsApp"}, ], } # ============================================================ # CORS — Lista explícita, sin wildcard (OWASP A05) # ============================================================ CORS_ALLOW_ALL_ORIGINS = False CORS_ALLOWED_ORIGINS = config( "CORS_ALLOWED_ORIGINS", default="http://localhost:3000,http://127.0.0.1:3000,http://localhost:8000,http://127.0.0.1:8000", cast=Csv(), ) CORS_ALLOW_CREDENTIALS = True CORS_ALLOW_METHODS = [ "DELETE", "GET", "OPTIONS", "PATCH", "POST", "PUT", ] CORS_ALLOW_HEADERS = [ "accept", "accept-encoding", "authorization", "content-type", "dnt", "origin", "user-agent", "x-csrftoken", "x-requested-with", ] # ============================================================ # CSP — Content Security Policy (OWASP A03/A05) # ============================================================ CONTENT_SECURITY_POLICY = { "DIRECTIVES": { "default-src": ["'self'"], "script-src": ["'self'", "'unsafe-inline'", "https://cdn.tailwindcss.com", "https://cdn.jsdelivr.net"], "style-src": ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"], "font-src": ["'self'", "https://fonts.gstatic.com", "data:"], "img-src": ["'self'", "data:", "https:"], "connect-src": ["'self'"], "frame-ancestors": ["'none'"], "base-uri": ["'self'"], "form-action": ["'self'"], }, } # ============================================================ # RATE LIMITING # ============================================================ RATELIMIT_ENABLE = True RATELIMIT_USE_CACHE = "default" RATELIMIT_FAIL_OPEN = True # True = si el caché falla, permitir la petición (no tumbar la app) # ============================================================ # CELERY # ============================================================ CELERY_BROKER_URL = config("CELERY_BROKER_URL", default="redis://redis:6379/1") CELERY_RESULT_BACKEND = config("CELERY_RESULT_BACKEND", default="redis://redis:6379/2") CELERY_ACCEPT_CONTENT = ["json"] CELERY_TASK_SERIALIZER = "json" CELERY_RESULT_SERIALIZER = "json" CELERY_TIMEZONE = TIME_ZONE CELERY_BEAT_SCHEDULER = "django_celery_beat.schedulers:DatabaseScheduler" CELERY_BROKER_CONNECTION_RETRY_ON_STARTUP = True CELERY_BROKER_CONNECTION_TIMEOUT = 4 CELERY_BROKER_CONNECTION_MAX_RETRIES = 1 CELERY_RESULT_BACKEND_ALWAYS_RETRY = False # ============================================================ # EMAIL # ============================================================ EMAIL_BACKEND = "django.core.mail.backends.smtp.EmailBackend" EMAIL_HOST = config("EMAIL_HOST", default="smtp.gmail.com") EMAIL_PORT = config("EMAIL_PORT", default=587, cast=int) EMAIL_USE_TLS = config("EMAIL_USE_TLS", default=True, cast=bool) EMAIL_HOST_USER = config("EMAIL_HOST_USER", default="") EMAIL_HOST_PASSWORD = config("EMAIL_HOST_PASSWORD", default="") # ============================================================ # WHATSAPP — Meta WhatsApp Business API # ============================================================ WHATSAPP_API_URL = config("WHATSAPP_API_URL", default="https://graph.facebook.com/v18.0/") WHATSAPP_TOKEN = config("WHATSAPP_TOKEN", default="") WHATSAPP_PHONE_ID = config("WHATSAPP_PHONE_ID", default="") WHATSAPP_VERIFY_TOKEN = config("WHATSAPP_VERIFY_TOKEN", default="") WHATSAPP_MAX_RETRIES = 3 WHATSAPP_RETRY_DELAYS = [60, 300, 900] # 1min, 5min, 15min # ============================================================ # PRIMARY KEY # ============================================================ DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField" # ============================================================ # LOGGING — Configurado en cada entorno # ============================================================ LOG_DIR = PROJECT_DIR / "logs" LOG_DIR.mkdir(exist_ok=True)