settings_prod.py

"""
Django settings for project project.
Generated by 'django-admin startproject' using Django 3.1.
For more information on this file, see
https://docs.djangoproject.com/en/3.1/topics/settings/
For the full list of settings and their values, see
https://docs.djangoproject.com/en/3.1/ref/settings/
"""

import os
import os.path
from pathlib import Path

import environ
import yaml

from .version import APP_VERSION  # pylint: disable=unused-import

env = environ.Env()

# Build paths inside the project like this: BASE_DIR / 'subdir'.
BASE_DIR = Path(__file__).resolve(strict=True).parent.parent.parent
os.environ['BASE_DIR'] = str(BASE_DIR)
print(f"BASE_DIR is {BASE_DIR}")

# SECURITY WARNING: keep the secret key used in production secret!
SECRET_KEY = env('SECRET_KEY', default=None)

# SECURITY WARNING: don't run with debug turned on in production!
DEBUG = False

# If set to True, this will enable logger.debug prints of the output of
# EXPLAIN.. ANALYZE of certain queries and the corresponding SQL statement.
DEBUG_ENABLE_DB_EXPLAIN_ANALYZE = False

# SECURITY:
# https://docs.djangoproject.com/en/dev/ref/settings/#secure-proxy-ssl-header
SECURE_PROXY_SSL_HEADER = ('HTTP_CLOUDFRONT_FORWARDED_PROTO', 'https')

# We need to have the IP of the Pod/localhost in ALLOWED_HOSTS
# as well to be able to scrape prometheus /metrics
# see kubernetes config on how `THIS_POD_IP` is obtained

ALLOWED_HOSTS = []
THIS_POD_IP = env('THIS_POD_IP', default=None)
if THIS_POD_IP:
    ALLOWED_HOSTS.append(THIS_POD_IP)
ALLOWED_HOSTS += env('ALLOWED_HOSTS', default='').split(',')

# SERVICE_HOST = os.getenv('SERVICE_HOST', '127.0.0.1:8000')

# Application definition
# Apps are grouped according to
# 1. django apps
# 2. third-party apps
# 3. own apps
INSTALLED_APPS = [
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'django.contrib.gis',
    'rest_framework',
    'rest_framework_gis',
    'rest_framework.authtoken',
    #  Note: If you use TokenAuthentication in production you must ensure
    #  that your API is only available over https.
    'admin_auto_filters',
    'storages',
    'whitenoise.runserver_nostatic',
    'django_prometheus',
    'pgtrigger',
    'config.apps.StacAdminConfig',
    'stac_api.apps.StacApiConfig',
]

# API Authentication options
FEATURE_AUTH_ENABLE_APIGW = env('FEATURE_AUTH_ENABLE_APIGW', bool, default=False)
FEATURE_AUTH_RESTRICT_V1 = env('FEATURE_AUTH_RESTRICT_V1', bool, default=False)

# Middlewares are executed in order, once for the incoming
# request top-down, once for the outgoing response bottom up
# Note: The prometheus middlewares should always be first and
# last, put everything else in between
MIDDLEWARE = [
    'django_prometheus.middleware.PrometheusBeforeMiddleware',
    # Middleware to add request to thread variables, this should be far up in the chain so request
    # information can be added to as many logs as possible.
    'logging_utilities.django_middlewares.add_request_context.AddToThreadContextMiddleware',
    'middleware.logging.RequestResponseLoggingMiddleware',
    'django.middleware.security.SecurityMiddleware',
    'middleware.cors.CORSHeadersMiddleware',
    'whitenoise.middleware.WhiteNoiseMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'middleware.api_gateway_middleware.ApiGatewayMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
    'middleware.cache_headers.CacheHeadersMiddleware',
    'middleware.exception.ExceptionLoggingMiddleware',
    'django_prometheus.middleware.PrometheusAfterMiddleware',
]

AUTHENTICATION_BACKENDS = [
    "middleware.api_gateway_middleware.ApiGatewayUserBackend",
    # We keep ModelBackend as fallback until we have moved all users to Cognito.
    "django.contrib.auth.backends.ModelBackend",
]

ROOT_URLCONF = 'config.urls'
API_BASE = 'api'
STAC_BASE = f'{API_BASE}/stac'
LOGIN_URL = "/api/stac/admin/login/"

TEMPLATES = [
    {
        'BACKEND': 'django.template.backends.django.DjangoTemplates',
        'DIRS': [BASE_DIR / 'app/templates'],
        'APP_DIRS': True,
        'OPTIONS': {
            'context_processors': [
                'django.template.context_processors.debug',
                'django.template.context_processors.request',
                'django.contrib.auth.context_processors.auth',
                'django.contrib.messages.context_processors.messages',
                'middleware.settings_context_processor.inject_settings_values',
            ],
        },
    },
]

WSGI_APPLICATION = 'wsgi.application'

# Database
# https://docs.djangoproject.com/en/3.1/ref/settings/#databases

DATABASES = {
    'default': {
        'ENGINE': 'django.contrib.gis.db.backends.postgis',
        'NAME': env('DB_NAME', default='service_stac'),
        'USER': env('DB_USER', default='service_stac'),
        'PASSWORD': env('DB_PW', default='service_stac'),
        'HOST': env('DB_HOST', default='service_stac'),
        'PORT': env.int('DB_PORT', default=5432),
        'TEST': {
            'NAME': env('DB_NAME_TEST', default='test_service_stac'),
        }
    }
}

DEFAULT_AUTO_FIELD = 'django.db.models.AutoField'

# Password validation
# https://docs.djangoproject.com/en/3.1/ref/settings/#auth-password-validators

AUTH_PASSWORD_VALIDATORS = [
    {
        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator'
    }, {
        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator'
    }, {
        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator'
    }, {
        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator'
    }
]

# Internationalization
# https://docs.djangoproject.com/en/3.1/topics/i18n/

LANGUAGE_CODE = 'en-us'

TIME_ZONE = 'UTC'

USE_I18N = True

USE_TZ = True

# Static files (CSS, JavaScript, Images)
# https://docs.djangoproject.com/en/3.1/howto/static-files/

STATIC_HOST = env('DJANGO_STATIC_HOST', default='')
STATIC_URL = f'{STATIC_HOST}/api/stac/static/'
STATIC_SPEC_URL = f'{STATIC_URL}spec/'
# "manage.py collectstatic" will copy all static files to this directory, and
# whitenoise will serve the static files that are in this directory (unless DEBUG=true in which case
# it will serve the files from the same directories "manage.py collectstatic" collects data from)
STATIC_ROOT = BASE_DIR / 'var' / 'www' / 'stac_api' / 'static_files'
STATICFILES_DIRS = [BASE_DIR / "spec" / "static", BASE_DIR / "app" / "stac_api" / "templates"]
# STATICFILES_STORAGE =
HEALTHCHECK_ENDPOINT = env('HEALTHCHECK_ENDPOINT', default='healthcheck')

try:
    WHITENOISE_MAX_AGE = env.int('HTTP_STATIC_CACHE_SECONDS', default=3600)
except ValueError as error:
    raise ValueError(
        'Invalid HTTP_STATIC_CACHE_SECONDS environment value: must be an integer'
    ) from error
WHITENOISE_MIMETYPES = {
    # These sets the mime types for the api/stac/static/spec/v0.9/openapi.yaml static file
    # otherwise a default application/octet-stream is used.
    '.yaml': 'application/vnd.oai.openapi+yaml;version=3.0',
    '.yml': 'application/vnd.oai.openapi+yaml;version=3.0'
}

DELETE_EXPIRED_ITEMS_OLDER_THAN_HOURS = 24
DELETE_EXPIRED_ITEMS_MAX = 110 * 1000
DELETE_EXPIRED_ITEMS_MAX_PERCENTAGE = 50
DELETE_EXPIRED_ITEMS_BATCH_SIZE = 10 * 1000

# Media files (i.e. uploaded content=assets in this project)
UPLOAD_FILE_CHUNK_SIZE = 1024 * 1024  # Size in Bytes
STORAGES = {
    'default': {
        "BACKEND": "stac_api.storages.LegacyS3Storage"
    },  # repeating this here for an easy access in the code. Default
    # is mandatory too
    'legacy': {
        "BACKEND": "stac_api.storages.LegacyS3Storage"
    },
    'staticfiles': {
        'BACKEND': 'whitenoise.storage.CompressedManifestStaticFilesStorage'
    },
    'managed': {
        "BACKEND": "stac_api.storages.ManagedS3Storage"
    }
}

try:
    AWS_SETTINGS = {
        'legacy': {
            # the legacy configuration will be read from the environment variables
            # specifically configured for that
            "access_type": "key",
            "S3_BUCKET_NAME": env("LEGACY_AWS_S3_BUCKET_NAME"),
            "ACCESS_KEY_ID": env('LEGACY_AWS_ACCESS_KEY_ID'),
            "SECRET_ACCESS_KEY": env('LEGACY_AWS_SECRET_ACCESS_KEY'),
            "S3_REGION_NAME": env('LEGACY_AWS_S3_REGION_NAME', default='eu-west-1'),
            # This is the URL where to reach the S3 service and is either minio
            # on localhost or https://s3.<region>.amazonaws.com
            "S3_ENDPOINT_URL": env('LEGACY_AWS_S3_ENDPOINT_URL', default=None),
            # The CUSTOM_DOMAIN is used to construct the correct URL when displaying
            # a link to the file in the admin UI. It must only contain the domain, but not
            # the scheme (http/https).
            "S3_CUSTOM_DOMAIN": env('LEGACY_AWS_S3_CUSTOM_DOMAIN', default=None),
            "S3_SIGNATURE_VERSION": "s3v4"
        },
        'managed': {
            # The managed configuration will be passed directly via env
            # The access to the managed bucket is done via service account
            "access_type": "service_account",
            "S3_BUCKET_NAME": env("AWS_S3_BUCKET_NAME"),
            "S3_REGION_NAME": env('AWS_S3_REGION_NAME', default='eu-central-1'),
            "S3_ENDPOINT_URL": env('AWS_S3_ENDPOINT_URL', default=None),
            "S3_CUSTOM_DOMAIN": env('AWS_S3_CUSTOM_DOMAIN', default=None),
            "S3_SIGNATURE_VERSION": "s3v4"
        }
    }
except KeyError as err:
    raise KeyError(f'AWS configuration {err} missing') from err

AWS_PRESIGNED_URL_EXPIRES = env.int('AWS_PRESIGNED_URL_EXPIRES', default=3600)

# Configure the caching
# API default cache control max-age
try:
    CACHE_MIDDLEWARE_SECONDS = env.int('HTTP_CACHE_SECONDS', default=600)
except ValueError as error:
    raise ValueError('Invalid HTTP_CACHE_SECONDS environment value: must be an integer') from error

# Asset data default cache control max-age
try:
    STORAGE_ASSETS_CACHE_SECONDS = env.int('HTTP_ASSETS_CACHE_SECONDS', default=7200)
except ValueError as err:
    raise ValueError('Invalid HTTP_ASSETS_CACHE_SECONDS, must be an integer') from err

# Search and collection list endpoint cache settings
# The cache is used for the search and collection list endpoints, which is disabled by default.
# Each collection might have different cache settings due to the cache_control_header field at
# the collection level, therefore to keep endpoint simple, that returns multiple collections
# content, we disable the cache by default.
COLLECTIONS_AGGREGATE_CACHE_SECONDS = env.int('COLLECTIONS_AGGREGATE_CACHE_SECONDS', default=0)

# Logging
# https://docs.djangoproject.com/en/3.1/topics/logging/


# Read configuration from file
def get_logging_config():
    '''Read logging configuration
    Read and parse the yaml logging configuration file passed in the environment variable
    LOGGING_CFG and return it as dictionary
    Note: LOGGING_CFG is relative to the root of the repo
    '''
    log_config_file = env('LOGGING_CFG', default='app/config/logging-cfg-local.yml')
    if log_config_file.lower() in ['none', '0', '', 'false', 'no']:
        return {}
    log_config = {}
    with open(BASE_DIR / log_config_file, 'rt', encoding="utf-8") as fd:
        log_config = yaml.safe_load(os.path.expandvars(fd.read()))
    return log_config


LOGGING = get_logging_config()

LOGGING_MAX_REQUEST_PAYLOAD_SIZE = env.int('LOGGING_MAX_REQUEST_PAYLOAD_SIZE', default=200)
LOGGING_MAX_RESPONSE_PAYLOAD_SIZE = env.int('LOGGING_MAX_RESPONSE_PAYLOAD_SIZE', default=200)

# Testing

TEST_RUNNER = 'tests.runner.TestRunner'

# set default pagination configuration
# set authentication schemes

REST_FRAMEWORK = {
    'DEFAULT_RENDERER_CLASSES': [
        'rest_framework.renderers.JSONRenderer',
        'helpers.renderers.GeoJSONRenderer',
    ],
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'middleware.api_gateway_authentication.ApiGatewayAuthentication',
        'middleware.rest_framework_authentication.RestrictedBasicAuthentication',
        'middleware.rest_framework_authentication.RestrictedTokenAuthentication',
        'middleware.rest_framework_authentication.RestrictedSessionAuthentication',
    ],
    'DEFAULT_PAGINATION_CLASS': 'stac_api.pagination.CursorPagination',
    'PAGE_SIZE': env.int('PAGE_SIZE', default=100),
    'PAGE_SIZE_LIMIT': env.int('PAGE_SIZE_LIMIT', default=100),
    'EXCEPTION_HANDLER': 'stac_api.apps.custom_exception_handler',
    'DEFAULT_PERMISSION_CLASSES': [
        'rest_framework.permissions.DjangoModelPermissionsOrAnonReadOnly',
    ]
}

# Exception handling

# When DEBUG is true the uncaught exceptions are handle by django a returns a detail exception
# backtrace as HTML, we can force to give a JSON message as in prod by settings this variable,
# this is usefull for unittest when we want to test exception handling. This settings can be set
# via environment variable in settings_dev.py when DEBUG=True
DEBUG_PROPAGATE_API_EXCEPTIONS = False

# Timeout in seconds for call to external services, e.g. HTTP HEAD request to
# data.geo.admin.ch/collection/item/asset to check if asset exists.
EXTERNAL_SERVICE_TIMEOUT = 3

# By default django_prometheus tracks the number of migrations
# This causes troubles in various places so we disable it
PROMETHEUS_EXPORT_MIGRATIONS = False

# STAC Browser configuration for auto generated STAC links
STAC_BROWSER_HOST = env(
    'STAC_BROWSER_HOST', default=None
)  # if None, the host is taken from the request url
STAC_BROWSER_BASE_PATH = env('STAC_BROWSER_BASE_PATH', default='browser/index.html')

# Pattern prefixes of collections that should go to the managed bucket
MANAGED_BUCKET_COLLECTION_PATTERNS = env.list('MANAGED_BUCKET_COLLECTION_PATTERNS', default=[])

# Pattern prefixes of collections that should should *not* go to the managed bucket
MANAGED_BUCKET_COLLECTION_PATTERNS_BLACKLIST = env.list(
    'MANAGED_BUCKET_COLLECTION_PATTERNS_BLACKLIST', default=[""]
)

# the duration in seconds that the validator should try and reach the external URL
EXTERNAL_URL_REACHABLE_TIMEOUT = env.int('EXTERNAL_URL_REACHABLE_TIMEOUT', default=5)

DISALLOWED_EXTERNAL_ASSET_URL_SCHEMES = env.list(
    'DISALLOWED_EXTERNAL_ASSET_URL_SCHEMES', default=['http']
)

# These are the default values from Django as per
# https://docs.djangoproject.com/en/5.1/ref/settings/
# We add them here so they can be changed through environment variables.
SESSION_EXPIRE_AT_BROWSER_CLOSE = env('SESSION_EXPIRE_AT_BROWSER_CLOSE', bool, default=False)
SESSION_COOKIE_AGE = env('SESSION_COOKIE_AGE', int, default=60 * 60 * 24 * 7 * 2)
SESSION_COOKIE_SAMESITE = env('SESSION_COOKIE_SAMESITE', str, default='Lax')
SESSION_COOKIE_SECURE = env('SESSION_COOKIE_SECURE', bool, default=False)

# Delay to inject in the checker endpoint, in seconds. This is only meant to be
# used for test purpose.
CHECKER_DELAY = env('CHECKER_DELAY', int, default=0)