first commit

backend/app/core/config.py

@@ -0,0 +1,105 @@
+from functools import lru_cache
+
+from pydantic import field_validator, model_validator
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+_INSECURE_SECRET_KEYS = frozenset(
+    {
+        "change-me",
+        "change-me-to-a-long-random-string-in-production",
+        "changeme",
+        "secret",
+    }
+)
+
+
+class Settings(BaseSettings):
+    model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8", extra="ignore")
+
+    environment: str = "development"
+    database_url: str
+    secret_key: str
+    access_token_expire_minutes: int = 60 * 24
+
+    payment_provider: str = "mock"
+    payment_mock_secret: str = "dev-mock-payment-secret-change-me"
+    razorpay_key_id: str | None = None
+    razorpay_key_secret: str | None = None
+    razorpay_webhook_secret: str | None = None
+    order_payment_timeout_minutes: int = 15
+    ticket_verify_api_key: str | None = None
+
+    @field_validator("secret_key")
+    @classmethod
+    def secret_key_must_be_strong_in_production(cls, value: str, info) -> str:
+        environment = (info.data.get("environment") or "development").lower()
+        if environment == "production" and value.strip().lower() in _INSECURE_SECRET_KEYS:
+            raise ValueError("SECRET_KEY must be set to a long random value in production")
+        if environment == "production" and len(value) < 32:
+            raise ValueError("SECRET_KEY must be at least 32 characters in production")
+        return value
+
+    @field_validator("access_token_expire_minutes")
+    @classmethod
+    def token_ttl_reasonable(cls, value: int) -> int:
+        if value < 5 or value > 60 * 24 * 14:
+            raise ValueError("ACCESS_TOKEN_EXPIRE_MINUTES must be between 5 and 20160")
+        return value
+
+    cors_origins: str = "http://localhost:5173,http://127.0.0.1:5173"
+
+    upload_dir: str = "uploads"
+    storage_backend: str = "local"
+
+    public_site_url: str = "http://localhost:5173"
+    public_api_url: str = "http://localhost:8000"
+
+    admin_email: str = "admin@desiclans.in"
+    admin_password: str = "changeme"
+
+    smtp_host: str | None = None
+    smtp_port: int = 587
+    smtp_user: str | None = None
+    smtp_password: str | None = None
+    smtp_from: str | None = None
+    smtp_use_tls: bool = True
+    alert_notify_email: str | None = None
+    alert_click_threshold: int = 50
+
+    aws_access_key_id: str | None = None
+    aws_secret_access_key: str | None = None
+    aws_region: str = "ap-south-1"
+    s3_bucket: str | None = None
+    s3_public_base_url: str | None = None
+
+    @property
+    def cors_origin_list(self) -> list[str]:
+        return [origin.strip() for origin in self.cors_origins.split(",") if origin.strip()]
+
+    @property
+    def smtp_configured(self) -> bool:
+        return bool(self.smtp_host and self.alert_notify_email)
+
+    @model_validator(mode="after")
+    def production_hardening(self) -> "Settings":
+        if self.environment.lower() != "production":
+            return self
+        if self.payment_provider.lower() == "mock":
+            raise ValueError("PAYMENT_PROVIDER must be razorpay in production")
+        if not self.ticket_verify_api_key or len(self.ticket_verify_api_key) < 16:
+            raise ValueError("TICKET_VERIFY_API_KEY is required in production (min 16 characters)")
+        if self.admin_password.strip().lower() in {"changeme", "change-me", "password"}:
+            raise ValueError("ADMIN_PASSWORD must be changed from the default in production")
+        if not self.cors_origin_list:
+            raise ValueError("CORS_ORIGINS must list at least one origin in production")
+        if self.payment_provider.lower() == "razorpay":
+            if not self.razorpay_key_id or not self.razorpay_key_secret or not self.razorpay_webhook_secret:
+                raise ValueError(
+                    "RAZORPAY_KEY_ID, RAZORPAY_KEY_SECRET, and RAZORPAY_WEBHOOK_SECRET are required in production"
+                )
+        return self
+
+
+@lru_cache
+def get_settings() -> Settings:
+    return Settings()