192 lines
11 KiB
Python
192 lines
11 KiB
Python
from pydantic_settings import BaseSettings, SettingsConfigDict
|
|
from pydantic import Field
|
|
from typing import List
|
|
import os
|
|
|
|
class Settings(BaseSettings):
|
|
model_config = SettingsConfigDict(env_file='.env', env_file_encoding='utf-8', case_sensitive=False, extra='ignore')
|
|
APP_NAME: str = Field(default='Hotel Booking API', description='Application name')
|
|
APP_VERSION: str = Field(default='1.0.0', description='Application version')
|
|
ENVIRONMENT: str = Field(default='development', description='Environment: development, staging, production')
|
|
DEBUG: bool = Field(default=False, description='Debug mode')
|
|
API_V1_PREFIX: str = Field(default='/api/v1', description='API v1 prefix')
|
|
HOST: str = Field(default='0.0.0.0', description='Server host. WARNING: 0.0.0.0 binds to all interfaces. Use 127.0.0.1 for development or specific IP for production.') # nosec B104 # Acceptable default with validation warning in production
|
|
PORT: int = Field(default=8000, description='Server port')
|
|
DB_USER: str = Field(default='root', description='Database user')
|
|
DB_PASS: str = Field(default='', description='Database password')
|
|
DB_NAME: str = Field(default='hotel_db', description='Database name')
|
|
DB_HOST: str = Field(default='localhost', description='Database host')
|
|
DB_PORT: str = Field(default='3306', description='Database port')
|
|
JWT_SECRET: str = Field(default='', description='JWT secret key - MUST be set via environment variable. Minimum 64 characters recommended for production.')
|
|
JWT_ALGORITHM: str = Field(default='HS256', description='JWT algorithm')
|
|
JWT_ACCESS_TOKEN_EXPIRE_MINUTES: int = Field(default=30, description='JWT access token expiration in minutes')
|
|
JWT_REFRESH_TOKEN_EXPIRE_DAYS: int = Field(default=3, description='JWT refresh token expiration in days (reduced from 7 for better security)')
|
|
MAX_LOGIN_ATTEMPTS: int = Field(default=5, description='Maximum failed login attempts before account lockout')
|
|
ACCOUNT_LOCKOUT_DURATION_MINUTES: int = Field(default=30, description='Account lockout duration in minutes after max failed attempts')
|
|
ENCRYPTION_KEY: str = Field(default='', description='Base64-encoded encryption key for data encryption at rest')
|
|
CLIENT_URL: str = Field(default='http://localhost:5173', description='Frontend client URL')
|
|
CORS_ORIGINS: List[str] = Field(default_factory=lambda: ['http://localhost:5173', 'http://localhost:3000', 'http://127.0.0.1:5173'], description='Allowed CORS origins')
|
|
RATE_LIMIT_ENABLED: bool = Field(default=True, description='Enable rate limiting')
|
|
RATE_LIMIT_PER_MINUTE: int = Field(default=60, description='Requests per minute per IP')
|
|
RATE_LIMIT_ADMIN_PER_MINUTE: int = Field(default=300, description='Requests per minute for admin users')
|
|
RATE_LIMIT_STAFF_PER_MINUTE: int = Field(default=200, description='Requests per minute for staff users')
|
|
RATE_LIMIT_ACCOUNTANT_PER_MINUTE: int = Field(default=200, description='Requests per minute for accountant users')
|
|
RATE_LIMIT_CUSTOMER_PER_MINUTE: int = Field(default=100, description='Requests per minute for customer users')
|
|
CSRF_PROTECTION_ENABLED: bool = Field(default=True, description='Enable CSRF protection')
|
|
HSTS_PRELOAD_ENABLED: bool = Field(default=False, description='Enable HSTS preload directive (requires domain submission to hstspreload.org)')
|
|
LOG_LEVEL: str = Field(default='INFO', description='Log level: DEBUG, INFO, WARNING, ERROR, CRITICAL')
|
|
LOG_FILE: str = Field(default='logs/app.log', description='Log file path')
|
|
LOG_MAX_BYTES: int = Field(default=10485760, description='Max log file size (10MB)')
|
|
LOG_BACKUP_COUNT: int = Field(default=5, description='Number of backup log files')
|
|
SMTP_HOST: str = Field(default='smtp.gmail.com', description='SMTP host')
|
|
SMTP_PORT: int = Field(default=587, description='SMTP port')
|
|
SMTP_USER: str = Field(default='', description='SMTP username')
|
|
SMTP_PASSWORD: str = Field(default='', description='SMTP password')
|
|
SMTP_FROM_EMAIL: str = Field(default='', description='From email address')
|
|
SMTP_FROM_NAME: str = Field(default='Hotel Booking', description='From name')
|
|
UPLOAD_DIR: str = Field(default='uploads', description='Upload directory')
|
|
MAX_UPLOAD_SIZE: int = Field(default=5242880, description='Max upload size in bytes (5MB)')
|
|
MAX_REQUEST_BODY_SIZE: int = Field(default=10485760, description='Max request body size in bytes (10MB)')
|
|
ALLOWED_EXTENSIONS: List[str] = Field(default_factory=lambda: ['jpg', 'jpeg', 'png', 'gif', 'webp'], description='Allowed file extensions')
|
|
REDIS_ENABLED: bool = Field(default=False, description='Enable Redis caching')
|
|
REDIS_HOST: str = Field(default='localhost', description='Redis host')
|
|
REDIS_PORT: int = Field(default=6379, description='Redis port')
|
|
REDIS_DB: int = Field(default=0, description='Redis database number')
|
|
REDIS_PASSWORD: str = Field(default='', description='Redis password')
|
|
REQUEST_TIMEOUT: int = Field(default=30, description='Request timeout in seconds')
|
|
HEALTH_CHECK_INTERVAL: int = Field(default=30, description='Health check interval in seconds')
|
|
STRIPE_SECRET_KEY: str = Field(default='', description='Stripe secret key')
|
|
STRIPE_PUBLISHABLE_KEY: str = Field(default='', description='Stripe publishable key')
|
|
STRIPE_WEBHOOK_SECRET: str = Field(default='', description='Stripe webhook secret')
|
|
PAYPAL_CLIENT_ID: str = Field(default='', description='PayPal client ID')
|
|
PAYPAL_CLIENT_SECRET: str = Field(default='', description='PayPal client secret')
|
|
PAYPAL_MODE: str = Field(default='sandbox', description='PayPal mode: sandbox or live')
|
|
BORICA_TERMINAL_ID: str = Field(default='', description='Borica Terminal ID')
|
|
BORICA_MERCHANT_ID: str = Field(default='', description='Borica Merchant ID')
|
|
BORICA_PRIVATE_KEY_PATH: str = Field(default='', description='Borica private key file path')
|
|
BORICA_CERTIFICATE_PATH: str = Field(default='', description='Borica certificate file path')
|
|
BORICA_GATEWAY_URL: str = Field(default='https://3dsgate-dev.borica.bg/cgi-bin/cgi_link', description='Borica gateway URL (test or production)')
|
|
BORICA_MODE: str = Field(default='test', description='Borica mode: test or production')
|
|
|
|
@property
|
|
def database_url(self) -> str:
|
|
"""Generate database URL with proper credential escaping to prevent injection."""
|
|
from urllib.parse import quote_plus
|
|
# Properly escape credentials to handle special characters
|
|
user = quote_plus(self.DB_USER)
|
|
password = quote_plus(self.DB_PASS)
|
|
host = quote_plus(self.DB_HOST)
|
|
port = str(self.DB_PORT)
|
|
name = quote_plus(self.DB_NAME)
|
|
return f'mysql+pymysql://{user}:{password}@{host}:{port}/{name}'
|
|
|
|
@property
|
|
def is_production(self) -> bool:
|
|
return self.ENVIRONMENT.lower() == 'production'
|
|
|
|
@property
|
|
def is_development(self) -> bool:
|
|
return self.ENVIRONMENT.lower() == 'development'
|
|
|
|
@property
|
|
def redis_url(self) -> str:
|
|
if self.REDIS_PASSWORD:
|
|
return f'redis://:{self.REDIS_PASSWORD}@{self.REDIS_HOST}:{self.REDIS_PORT}/{self.REDIS_DB}'
|
|
return f'redis://{self.REDIS_HOST}:{self.REDIS_PORT}/{self.REDIS_DB}'
|
|
|
|
IP_WHITELIST_ENABLED: bool = Field(default=False, description='Enable IP whitelisting for admin endpoints')
|
|
ADMIN_IP_WHITELIST: List[str] = Field(default_factory=list, description='List of allowed IP addresses/CIDR ranges for admin endpoints')
|
|
|
|
def validate_host_configuration(self) -> None:
|
|
"""
|
|
Validate HOST configuration for security.
|
|
Warns if binding to all interfaces (0.0.0.0) in production.
|
|
"""
|
|
if self.HOST == '0.0.0.0' and self.is_production:
|
|
import logging
|
|
logger = logging.getLogger(__name__)
|
|
logger.warning(
|
|
'SECURITY WARNING: HOST is set to 0.0.0.0 in production. '
|
|
'This binds the server to all network interfaces. '
|
|
'Consider using a specific IP address or ensure proper firewall rules are in place.'
|
|
)
|
|
|
|
def validate_encryption_key(self) -> None:
|
|
"""
|
|
Validate encryption key is properly configured.
|
|
Raises ValueError if key is missing or invalid in production.
|
|
"""
|
|
if not self.ENCRYPTION_KEY:
|
|
if self.is_production:
|
|
raise ValueError(
|
|
'CRITICAL: ENCRYPTION_KEY is not configured in production. '
|
|
'Please set ENCRYPTION_KEY environment variable to a base64-encoded 32-byte key.'
|
|
)
|
|
else:
|
|
# In development, warn but don't fail
|
|
import logging
|
|
logger = logging.getLogger(__name__)
|
|
logger.warning(
|
|
'ENCRYPTION_KEY is not configured. Encryption operations may fail. '
|
|
'Please set ENCRYPTION_KEY environment variable.'
|
|
)
|
|
return
|
|
|
|
# Validate base64 encoding and key length (32 bytes = 44 base64 chars)
|
|
try:
|
|
import base64
|
|
decoded = base64.b64decode(self.ENCRYPTION_KEY)
|
|
if len(decoded) != 32:
|
|
raise ValueError(
|
|
f'ENCRYPTION_KEY must be a base64-encoded 32-byte key. '
|
|
f'Received {len(decoded)} bytes after decoding.'
|
|
)
|
|
except Exception as e:
|
|
if self.is_production:
|
|
raise ValueError(
|
|
f'Invalid ENCRYPTION_KEY format: {str(e)}. '
|
|
'Must be a valid base64-encoded 32-byte key.'
|
|
)
|
|
else:
|
|
import logging
|
|
logger = logging.getLogger(__name__)
|
|
logger.warning(f'Invalid ENCRYPTION_KEY format: {str(e)}')
|
|
|
|
settings = Settings()
|
|
|
|
# Validate JWT_SECRET on startup - fail fast if not configured
|
|
def validate_jwt_secret():
|
|
"""Validate JWT_SECRET is properly configured. Called on startup."""
|
|
if not settings.JWT_SECRET or settings.JWT_SECRET.strip() == '':
|
|
error_msg = (
|
|
'CRITICAL SECURITY ERROR: JWT_SECRET is not configured. '
|
|
'Please set JWT_SECRET environment variable to a secure random string. '
|
|
'Minimum 64 characters recommended for production. '
|
|
'Generate one using: python -c "import secrets; print(secrets.token_urlsafe(64))"'
|
|
)
|
|
import logging
|
|
logger = logging.getLogger(__name__)
|
|
logger.error(error_msg)
|
|
if settings.is_production:
|
|
raise ValueError(error_msg)
|
|
else:
|
|
logger.warning(
|
|
'JWT_SECRET not configured. This will cause authentication to fail. '
|
|
'Set JWT_SECRET environment variable before starting the application.'
|
|
)
|
|
|
|
# Warn if using weak secret (less than 64 characters)
|
|
if len(settings.JWT_SECRET) < 64:
|
|
import logging
|
|
logger = logging.getLogger(__name__)
|
|
if settings.is_production:
|
|
logger.warning(
|
|
f'JWT_SECRET is only {len(settings.JWT_SECRET)} characters. '
|
|
'Recommend using at least 64 characters for production security.'
|
|
)
|
|
else:
|
|
logger.debug(f'JWT_SECRET length: {len(settings.JWT_SECRET)} characters')
|
|
|
|
# Validate on import
|
|
validate_jwt_secret()
|
|
settings.validate_host_configuration() |