Fusion
577b052c05
User Profile (US-004): - Add authenticated profile endpoints (GET/PUT /users/me) - Add avatar upload with file validation (PNG/JPEG, max 2MB) - Create frontend profile page with edit form and avatar upload - Update app shell to link to profile page OAuth/Traefik Integration: - Externalize all Authentik URLs to environment variables - Add domain configuration (API_DOMAIN, WEB_DOMAIN, AUTHENTIK_DOMAIN) - Create docker-compose.traefik.yml for reverse proxy deployment - Update OAuth redirect/callback URLs to use configured domains - Add VITE_APP_URL for frontend public URL configuration Quality gates: pytest (50 passed), ruff, mypy, npm test (12 passed), typecheck, lint, build
118 lines
3.8 KiB
Python
118 lines
3.8 KiB
Python
from pydantic import Field
|
|
from pydantic_settings import BaseSettings, SettingsConfigDict
|
|
|
|
|
|
def build_database_url(
|
|
*,
|
|
user: str,
|
|
password: str,
|
|
host: str,
|
|
port: int,
|
|
database: str,
|
|
) -> str:
|
|
return f"postgresql+asyncpg://{user}:{password}@{host}:{port}/{database}"
|
|
|
|
|
|
class Settings(BaseSettings):
|
|
app_env: str = "development"
|
|
database_url_override: str | None = Field(default=None, alias="DATABASE_URL")
|
|
postgres_user: str = "headquarter"
|
|
postgres_password: str = "headquarter"
|
|
postgres_host: str = "postgres"
|
|
postgres_port: int = 5432
|
|
postgres_db: str = "headquarter"
|
|
|
|
# Domain configuration
|
|
api_domain: str = "localhost"
|
|
web_domain: str = "localhost"
|
|
authentik_domain: str = "authentik.local"
|
|
|
|
# Public URLs (constructed from domains if not explicitly set)
|
|
api_public_url: str | None = None
|
|
web_public_url: str | None = None
|
|
|
|
# Authentik configuration - no hardcoded URLs
|
|
authentik_client_id: str = "headquarter-web"
|
|
authentik_client_secret: str = "change-me"
|
|
authentik_authorize_url: str | None = None
|
|
authentik_token_url: str | None = None
|
|
authentik_jwks_url: str | None = None
|
|
authentik_issuer: str | None = None
|
|
authentik_audience: str = "headquarter-web"
|
|
|
|
jwt_secret: str = "change-me-jwt-secret"
|
|
jwt_algorithm: str = "HS256"
|
|
access_token_ttl_minutes: int = 15
|
|
refresh_token_ttl_days: int = 7
|
|
|
|
model_config = SettingsConfigDict(env_file=".env", extra="ignore", populate_by_name=True)
|
|
|
|
@property
|
|
def database_url(self) -> str:
|
|
if self.database_url_override:
|
|
return self.database_url_override
|
|
|
|
return build_database_url(
|
|
user=self.postgres_user,
|
|
password=self.postgres_password,
|
|
host=self.postgres_host,
|
|
port=self.postgres_port,
|
|
database=self.postgres_db,
|
|
)
|
|
|
|
@property
|
|
def api_base_url(self) -> str:
|
|
if self.api_public_url:
|
|
return self.api_public_url
|
|
protocol = "https" if self.app_env == "production" else "http"
|
|
port = "" if self.app_env == "production" else ":8000"
|
|
return f"{protocol}://{self.api_domain}{port}"
|
|
|
|
@property
|
|
def web_base_url(self) -> str:
|
|
if self.web_public_url:
|
|
return self.web_public_url
|
|
protocol = "https" if self.app_env == "production" else "http"
|
|
port = "" if self.app_env == "production" else ":3000"
|
|
return f"{protocol}://{self.web_domain}{port}"
|
|
|
|
@property
|
|
def authentik_base_url(self) -> str:
|
|
protocol = "https" if self.app_env == "production" else "http"
|
|
return f"{protocol}://{self.authentik_domain}"
|
|
|
|
@property
|
|
def resolved_authentik_authorize_url(self) -> str:
|
|
if self.authentik_authorize_url:
|
|
return self.authentik_authorize_url
|
|
return f"{self.authentik_base_url}/application/o/authorize/"
|
|
|
|
@property
|
|
def resolved_authentik_token_url(self) -> str:
|
|
if self.authentik_token_url:
|
|
return self.authentik_token_url
|
|
return f"{self.authentik_base_url}/application/o/token/"
|
|
|
|
@property
|
|
def resolved_authentik_jwks_url(self) -> str:
|
|
if self.authentik_jwks_url:
|
|
return self.authentik_jwks_url
|
|
return f"{self.authentik_base_url}/application/o/{self.authentik_client_id}/jwks/"
|
|
|
|
@property
|
|
def resolved_authentik_issuer(self) -> str:
|
|
if self.authentik_issuer:
|
|
return self.authentik_issuer
|
|
return f"{self.authentik_base_url}/application/o/{self.authentik_client_id}/"
|
|
|
|
@property
|
|
def cookie_secure(self) -> bool:
|
|
return self.app_env == "production"
|
|
|
|
@property
|
|
def cookie_samesite(self) -> str:
|
|
if self.app_env == "production":
|
|
return "strict"
|
|
|
|
return "lax"
|