justin
660fe7b37f
Backlog §2.10: registration issued a live session and email_verified_at was
written but never read, so an unverified user had full access and there was no
switch to require verification.
Add REQUIRE_EMAIL_VERIFICATION (default false). When true:
- resolve_session_user returns None for a user whose email_verified_at is null —
the single read-side gate covering every authenticated request, incl. the
session minted at registration.
- login raises 403 ("email not verified") instead of issuing a useless token.
Default false on purpose: self-hosts without SMTP, and accounts created before
this gate existed (email_verified_at null), must not be locked out. Operators
enable it once mail works and accounts are verified. Documented in .env.example.
Tests: default-off keeps unverified accounts working; on → register's session
won't resolve (401), login is 403, and after verify-email both work. 75 passed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>
67 lines
2.4 KiB
Python
67 lines
2.4 KiB
Python
"""Application configuration.
|
|
|
|
Twelve-factor: everything is read from the environment. Defaults are
|
|
development-friendly; production supplies real values via the compose `.env`.
|
|
No secrets or endpoints are hard-coded.
|
|
"""
|
|
|
|
from functools import lru_cache
|
|
|
|
from pydantic import Field
|
|
from pydantic_settings import BaseSettings, SettingsConfigDict
|
|
|
|
|
|
class Settings(BaseSettings):
|
|
model_config = SettingsConfigDict(
|
|
env_file=".env",
|
|
env_file_encoding="utf-8",
|
|
extra="ignore",
|
|
)
|
|
|
|
app_name: str = "Provenance"
|
|
version: str = "0.0.0"
|
|
app_env: str = Field(default="development", description="development | production")
|
|
|
|
# SQLAlchemy async URL, e.g. postgresql+asyncpg://user:pass@host:5432/db
|
|
database_url: str = Field(
|
|
default="postgresql+asyncpg://provenance:provenance@localhost:5432/provenance",
|
|
)
|
|
|
|
# --- Auth / sessions ---
|
|
session_ttl_days: int = 30
|
|
token_ttl_hours: int = 24 # email-verify / password-reset token lifetime
|
|
cookie_name: str = "provenance_session"
|
|
cookie_secure: bool = True # set false for local http; true behind TLS
|
|
# Base URL used to build links in outbound email.
|
|
app_base_url: str = "http://localhost"
|
|
|
|
# --- Object storage (S3-compatible / MinIO) ---
|
|
s3_endpoint_url: str = "http://minio:9000"
|
|
s3_bucket: str = "provenance"
|
|
s3_access_key: str = "provenance"
|
|
s3_secret_key: str = "change-me-too"
|
|
s3_region: str = "us-east-1"
|
|
s3_presign_ttl: int = 3600 # seconds
|
|
|
|
# --- Worker ---
|
|
purge_interval_seconds: int = 3600 # how often to run the soft-delete purge
|
|
purge_after_days: int = 30 # soft-deleted rows older than this are purged
|
|
|
|
# --- Email (SMTP) ---
|
|
# When true, a user with no verified email gets no active session (login is
|
|
# refused and existing sessions stop resolving). Default false so self-hosts
|
|
# without SMTP — and accounts created before this gate existed — aren't
|
|
# locked out; operators turn it on once mail works and accounts are verified.
|
|
require_email_verification: bool = False
|
|
mailer: str = Field(default="console", description="console | smtp")
|
|
smtp_host: str | None = None
|
|
smtp_port: int = 587
|
|
smtp_username: str | None = None
|
|
smtp_password: str | None = None
|
|
smtp_from: str = "Provenance <no-reply@provenance.local>"
|
|
|
|
|
|
@lru_cache
|
|
def get_settings() -> Settings:
|
|
return Settings()
|