<filename>backend/badbe/badbe/settings.py
"""
Django settings for badbe project.

Generated by 'django-admin startproject' using Django 1.11.26.

For more information on this file, see
https://docs.djangoproject.com/en/1.11/topics/settings/

For the full list of settings and their values, see
https://docs.djangoproject.com/en/1.11/ref/settings/

To verify the settings are production-ready, see
https://docs.djangoproject.com/en/3.0/howto/deployment/checklist/
"""

import os
from corsheaders.defaults import default_methods, default_headers

# SECURITY WARNING: Keep this value secret
# Consider https://docs.djangoproject.com/en/3.0/ref/settings/#std:setting-SECRET_KEY
SECRET_KEY = '<KEY>'

# SECURITY WARNING: Don't run with DEBUG = True in production
DEBUG = True

# Build paths inside the project like this: os.path.join(BASE_DIR, ...)
BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))

# Which HTTP Host header values are allowed
ALLOWED_HOSTS = ['localhost', '127.0.0.1']

INSTALLED_APPS = [
    # Django Apps
    'django.contrib.admin',
    # Core authentication framework and its default models.
    'django.contrib.auth',
    # Django content type system (allows permissions to be associated with models).
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',

    # Third-Party Apps
    'rest_framework',
    'django_filters',
    'rest_framework.authtoken',
    'rest_auth',
    'corsheaders',

    # Local Apps (Your project's apps)
    'polls.apps.PollsConfig',
]

MIDDLEWARE = [
    # Manages sessions across requests.
    'django.contrib.sessions.middleware.SessionMiddleware',
    # LocaleMiddleware must come after SessionMiddleware and CacheMiddleware but before CommonMiddleware
    'django.middleware.locale.LocaleMiddleware',  # Enables localization
    'django.middleware.security.SecurityMiddleware',
    # CorsMiddleware must be placed before any middleware that can generate responses, e.g. CommonMiddleware
    'corsheaders.middleware.CorsMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    # Associates users with requests using sessions
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    # 'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

ROOT_URLCONF = 'badbe.urls'

TEMPLATES = [
    {
        'BACKEND': 'django.template.backends.django.DjangoTemplates',
        'DIRS': [os.path.join(BASE_DIR, 'templates')],
        'APP_DIRS': True,
        'OPTIONS': {
            'context_processors': [
                'django.template.context_processors.debug',
                'django.template.context_processors.request',
                'django.contrib.auth.context_processors.auth',
                'django.contrib.messages.context_processors.messages',

            ],
        },
    },
]

WSGI_APPLICATION = 'badbe.wsgi.application'

# Database settings
# Consider https://docs.djangoproject.com/en/1.11/ref/settings/#databases
DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.sqlite3',
        'NAME': os.path.join(BASE_DIR, 'db', 'db.sqlite3'),
    }
}

# Password validation
# Consider https://docs.djangoproject.com/en/1.11/ref/settings/#auth-password-validators
AUTH_PASSWORD_VALIDATORS = [
    {
        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
    },
]

# Internationalization and localization
# Consider https://docs.djangoproject.com/en/3.0/topics/i18n/
LANGUAGE_CODE = 'de'
TIME_ZONE = 'CET'
USE_I18N = True
USE_L10N = True
USE_TZ = True

# Static files (CSS, JavaScript, Images)
# Consider https://docs.djangoproject.com/en/1.11/howto/static-files/
STATIC_URL = '/static/'

# Django REST Framework settings
REST_FRAMEWORK = {
    # Default authentication scheme
    # Consider https://www.django-rest-framework.org/api-guide/authentication/
    'DEFAULT_AUTHENTICATION_CLASSES': [
        # 'rest_framework.authentication.BasicAuthentication',
        'rest_framework.authentication.SessionAuthentication',
    ],
    # Global permission policy
    # Consider https://www.django-rest-framework.org/api-guide/permissions/
    'DEFAULT_PERMISSION_CLASSES': (
        # allow access to authenticated users only
        'rest_framework.permissions.IsAuthenticated',
    ),
    # Pagination defaults
    # Consider https://www.django-rest-framework.org/api-guide/pagination
    # 'DEFAULT_PAGINATION_CLASS': 'rest_framework.pagination.PageNumberPagination',
    # 'PAGE_SIZE': 200,

    'DEFAULT_FILTER_BACKENDS': (
        'django_filters.rest_framework.DjangoFilterBackend',
    ),
}

# The user model to be used for authentication
AUTH_USER_MODEL = 'polls.Account'

# Polls module settings
POLLS = {
    # Path to the chromedriver executable that will be used in Selenium tests
    'PATH_CHROMEDRIVER_EXECUTABLE': '/opt/chromedriver_79',

    # How many days in advance the first reminder is displayed for an appointment
    'NOTIFY_APPOINTMENT_AHEAD': 31,
}

############################################################
# Security Settings
# Consider: https://docs.djangoproject.com/en/3.0/ref/csrf/
############################################################

SECURE_SSL_REDIRECT = False  # Set 'True' with TLS

# Cross-Site Request Forgery (CSRF)
# CSRF_COOKIE_SECURE = False  # Set 'True' with TLS
# CSRF_TRUSTED_ORIGINS = ['127.0.0.1', ]  # A list of hosts which are trusted origins for unsafe requests

# Session Cookies
SESSION_COOKIE_SECURE = False  # Set 'True' with TLS
# Set 'True' to forbids JavaScript from accessing the cookie
SESSION_COOKIE_HTTPONLY = False
SESSION_COOKIE_SAMESITE = 'Lax'  # CSRF protection for the session cookie
SESSION_COOKIE_PATH = '/'

# Cross Origin Resource Sharing (CORS)
CORS_ORIGIN_ALLOW_ALL = False
CORS_ORIGIN_WHITELIST = (
    'http://127.0.0.1:4200',
    'https://127.0.0.1:4200',
)
CORS_ALLOW_METHODS = list(default_methods)
CORS_ALLOW_CREDENTIALS = False
