We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
CSRF
![image](https://user-images.githubusercontent.com/20540661/204228990-94d738c9-8bf7-41a9-8b81-d88acaa55148.png)


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `backend/config/settings/development.py`
Content:
```
1 from .base import *  # noqa: F403
2 
3 MIDDLEWARE.append("api.middleware.RangesMiddleware")  # noqa: F405
4 CORS_ORIGIN_WHITELIST = ("http://127.0.0.1:3000", "http://0.0.0.0:3000", "http://localhost:3000")
5 CSRF_TRUSTED_ORIGINS = CORS_ORIGIN_WHITELIST
6 # LOGGING = {
7 #     'version': 1,
8 #     'handlers': {
9 #         'console': {
10 #             'level': 'DEBUG',
11 #             'class': 'logging.StreamHandler',
12 #         }
13 #     },
14 #     'loggers': {
15 #         'django.db.backends': {
16 #             'level': 'DEBUG',
17 #             'handlers': ['console'],
18 #         },
19 #     }
20 # }
21
```

Path: `backend/config/settings/base.py`
Content:
```
1 """
2 Django settings for app project.
3 
4 For more information on this file, see
5 https://docs.djangoproject.com/en/2.0/topics/settings/
6 
7 For the full list of settings and their values, see
8 https://docs.djangoproject.com/en/2.0/ref/settings/
9 
10 Any setting that is configured via an environment variable may
11 also be set in a `.env` file in the project base directory.
12 """
13 from os import path
14 
15 import dj_database_url
16 from environs import Env, EnvError
17 from furl import furl
18 
19 # Build paths inside the project like this: path.join(BASE_DIR, ...)
20 BASE_DIR = path.dirname(path.dirname(path.dirname(path.abspath(__file__))))
21 
22 env = Env()
23 env.read_env(path.join(BASE_DIR, ".env"), recurse=False)
24 
25 # Quick-start development settings - unsuitable for production
26 # See https://docs.djangoproject.com/en/2.0/howto/deployment/checklist/
27 # SECURITY WARNING: keep the secret key used in production secret!
28 SECRET_KEY = env("SECRET_KEY", "v8sk33sy82!uw3ty=!jjv5vp7=s2phrzw(m(hrn^f7e_#1h2al")
29 
30 # SECURITY WARNING: don't run with debug turned on in production!
31 DEBUG = env.bool("DEBUG", True)
32 
33 # Application definition
34 INSTALLED_APPS = [
35     "whitenoise.runserver_nostatic",
36     "django.contrib.admin",
37     "django.contrib.auth",
38     "django.contrib.contenttypes",
39     "django.contrib.sessions",
40     "django.contrib.messages",
41     "django.contrib.staticfiles",
42     "api",
43     "roles",
44     "projects",
45     "metrics",
46     "users",
47     "data_import",
48     "data_export",
49     "auto_labeling",
50     "labels",
51     "label_types",
52     "examples",
53     "rest_framework",
54     "rest_framework.authtoken",
55     "django_filters",
56     "polymorphic",
57     "corsheaders",
58     "drf_yasg",
59     "allauth",
60     "allauth.account",
61     "allauth.socialaccount",
62     "dj_rest_auth",
63     "dj_rest_auth.registration",
64     "django_celery_results",
65     "django_drf_filepond",
66     "health_check",
67     "health_check.cache",
68     "health_check.storage",
69     "health_check.contrib.migrations",
70     "health_check.contrib.celery",
71     "django_cleanup",
72 ]
73 
74 
75 MIDDLEWARE = [
76     "django.middleware.security.SecurityMiddleware",
77     "whitenoise.middleware.WhiteNoiseMiddleware",
78     "django.contrib.sessions.middleware.SessionMiddleware",
79     "django.middleware.common.CommonMiddleware",
80     "django.middleware.csrf.CsrfViewMiddleware",
81     "django.contrib.auth.middleware.AuthenticationMiddleware",
82     "django.contrib.messages.middleware.MessageMiddleware",
83     "django.middleware.clickjacking.XFrameOptionsMiddleware",
84     "corsheaders.middleware.CorsMiddleware",
85 ]
86 
87 
88 ROOT_URLCONF = "config.urls"
89 WSGI_APPLICATION = "config.wsgi.application"
90 
91 # Django templates
92 TEMPLATES = [
93     {
94         "BACKEND": "django.template.backends.django.DjangoTemplates",
95         "DIRS": [path.join(BASE_DIR, "client/dist")],
96         "APP_DIRS": True,
97         "OPTIONS": {
98             "context_processors": [
99                 "django.template.context_processors.debug",
100                 "django.template.context_processors.request",
101                 "django.contrib.auth.context_processors.auth",
102                 "django.contrib.messages.context_processors.messages",
103             ],
104         },
105     },
106 ]
107 
108 # Static files (CSS, JavaScript, Images)
109 # https://docs.djangoproject.com/en/2.0/howto/static-files/
110 STATIC_URL = "/static/"
111 STATIC_ROOT = path.join(BASE_DIR, "staticfiles")
112 STATICFILES_DIRS = [
113     path.join(BASE_DIR, "client/dist/static"),
114 ]
115 # STATICFILES_STORAGE = "whitenoise.storage.CompressedManifestStaticFilesStorage"
116 STATICFILES_STORAGE = "whitenoise.storage.CompressedStaticFilesStorage"
117 
118 # Auth settings
119 AUTHENTICATION_BACKENDS = [
120     "django.contrib.auth.backends.ModelBackend",
121 ]
122 HEADER_AUTH_USER_NAME = env("HEADER_AUTH_USER_NAME", "")
123 HEADER_AUTH_USER_GROUPS = env("HEADER_AUTH_USER_GROUPS", "")
124 HEADER_AUTH_ADMIN_GROUP_NAME = env("HEADER_AUTH_ADMIN_GROUP_NAME", "")
125 HEADER_AUTH_GROUPS_SEPERATOR = env("HEADER_AUTH_GROUPS_SEPERATOR", default=",")
126 if HEADER_AUTH_USER_NAME and HEADER_AUTH_USER_GROUPS and HEADER_AUTH_ADMIN_GROUP_NAME:
127     MIDDLEWARE.append("api.middleware.HeaderAuthMiddleware")
128     AUTHENTICATION_BACKENDS.append("django.contrib.auth.backends.RemoteUserBackend")
129 
130 # Role settings
131 ROLE_PROJECT_ADMIN = env("ROLE_PROJECT_ADMIN", "project_admin")
132 ROLE_ANNOTATOR = env("ROLE_ANNOTATOR", "annotator")
133 ROLE_ANNOTATION_APPROVER = env("ROLE_ANNOTATION_APPROVER", "annotation_approver")
134 
135 # Password validation
136 # https://docs.djangoproject.com/en/2.0/ref/settings/#auth-password-validators
137 AUTH_PASSWORD_VALIDATORS = [
138     {
139         "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
140     },
141     {
142         "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
143     },
144     {
145         "NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
146     },
147     {
148         "NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
149     },
150 ]
151 
152 REST_FRAMEWORK = {
153     # Use Django's standard `django.contrib.auth` permissions,
154     # or allow read-only access for unauthenticated users.
155     "DEFAULT_PERMISSION_CLASSES": [
156         "rest_framework.permissions.DjangoModelPermissionsOrAnonReadOnly",
157         "rest_framework.permissions.IsAuthenticated",
158     ],
159     "DEFAULT_AUTHENTICATION_CLASSES": (
160         "rest_framework.authentication.SessionAuthentication",
161         "rest_framework.authentication.TokenAuthentication",
162     ),
163     "DEFAULT_PAGINATION_CLASS": "rest_framework.pagination.LimitOffsetPagination",
164     "PAGE_SIZE": env.int("DOCCANO_PAGE_SIZE", default=5),
165     "DEFAULT_FILTER_BACKENDS": ("django_filters.rest_framework.DjangoFilterBackend",),
166     "SEARCH_PARAM": "q",
167     "DEFAULT_RENDERER_CLASSES": (
168         "rest_framework.renderers.JSONRenderer",
169         "rest_framework.renderers.BrowsableAPIRenderer",
170         "rest_framework_xml.renderers.XMLRenderer",
171     ),
172 }
173 
174 # Internationalization
175 # https://docs.djangoproject.com/en/2.0/topics/i18n/
176 LANGUAGE_CODE = "en-us"
177 TIME_ZONE = "UTC"
178 USE_I18N = True
179 USE_L10N = True
180 USE_TZ = True
181 
182 # Testing
183 TEST_RUNNER = "xmlrunner.extra.djangotestrunner.XMLTestRunner"
184 TEST_OUTPUT_DIR = path.join(BASE_DIR, "junitxml")
185 
186 LOGIN_URL = "/login/"
187 LOGIN_REDIRECT_URL = "/projects/"
188 LOGOUT_REDIRECT_URL = "/"
189 
190 # Database
191 # https://docs.djangoproject.com/en/2.0/ref/settings/#databases
192 DATABASES = {
193     "default": {
194         "ENGINE": "django.db.backends.sqlite3",
195         "NAME": path.join(BASE_DIR, "db.sqlite3"),
196     }
197 }
198 # Change 'default' database configuration with $DATABASE_URL.
199 DATABASES["default"].update(
200     dj_database_url.config(
201         env="DATABASE_URL",
202         conn_max_age=env.int("DATABASE_CONN_MAX_AGE", 500),
203         ssl_require="sslmode" not in furl(env("DATABASE_URL", "")).args,
204     )
205 )
206 
207 # work-around for dj-database-url: explicitly disable ssl for sqlite
208 if DATABASES["default"].get("ENGINE") == "django.db.backends.sqlite3":
209     DATABASES["default"].get("OPTIONS", {}).pop("sslmode", None)
210 
211 # work-around for dj-database-url: patch ssl for mysql
212 if DATABASES["default"].get("ENGINE") == "django.db.backends.mysql":
213     DATABASES["default"].get("OPTIONS", {}).pop("sslmode", None)
214     if env("MYSQL_SSL_CA", None):
215         DATABASES["default"].setdefault("OPTIONS", {}).setdefault("ssl", {}).setdefault("ca", env("MYSQL_SSL_CA", None))
216 
217 # default to a sensible modern driver for Azure SQL
218 if DATABASES["default"].get("ENGINE") == "sql_server.pyodbc":
219     DATABASES["default"].setdefault("OPTIONS", {}).setdefault("driver", "ODBC Driver 17 for SQL Server")
220 
221 
222 # Sessions and CSRF
223 # Honor the 'X-Forwarded-Proto' header for request.is_secure()
224 SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
225 SESSION_COOKIE_SECURE = env.bool("SESSION_COOKIE_SECURE", False)
226 CSRF_COOKIE_SECURE = env.bool("CSRF_COOKIE_SECURE", False)
227 CSRF_TRUSTED_ORIGINS = env.list("CSRF_TRUSTED_ORIGINS", [])
228 
229 # Allow all host headers
230 ALLOWED_HOSTS = ["*"]
231 
232 if DEBUG:
233     CORS_ORIGIN_WHITELIST = ("http://127.0.0.1:3000", "http://0.0.0.0:3000", "http://localhost:3000")
234     CSRF_TRUSTED_ORIGINS = CORS_ORIGIN_WHITELIST
235 
236 # Batch size for importing data
237 IMPORT_BATCH_SIZE = env.int("IMPORT_BATCH_SIZE", 1000)
238 
239 # Necessary for email verification of new accounts
240 EMAIL_USE_TLS = env.bool("EMAIL_USE_TLS", False)
241 EMAIL_HOST = env("EMAIL_HOST", None)
242 EMAIL_HOST_USER = env("EMAIL_HOST_USER", None)
243 EMAIL_HOST_PASSWORD = env("EMAIL_HOST_PASSWORD", None)
244 EMAIL_PORT = env.int("EMAIL_PORT", 587)
245 DEFAULT_FROM_EMAIL = env("DEFAULT_FROM_EMAIL", "webmaster@localhost")
246 if not EMAIL_HOST:
247     EMAIL_BACKEND = "django.core.mail.backends.console.EmailBackend"
248 
249 
250 # User media files
251 MEDIA_ROOT = env("MEDIA_ROOT", path.join(BASE_DIR, "media"))
252 MEDIA_URL = "/media/"
253 
254 # Filepond settings
255 DJANGO_DRF_FILEPOND_UPLOAD_TMP = path.join(BASE_DIR, "filepond-temp-uploads")
256 DJANGO_DRF_FILEPOND_FILE_STORE_PATH = MEDIA_ROOT
257 
258 # File upload setting
259 MAX_UPLOAD_SIZE = env.int("MAX_UPLOAD_SIZE", pow(1024, 3))  # default: 1GB per a file
260 ENABLE_FILE_TYPE_CHECK = env.bool("ENABLE_FILE_TYPE_CHECK", False)
261 
262 # Celery settings
263 DJANGO_CELERY_RESULTS_TASK_ID_MAX_LENGTH = 191
264 CELERY_RESULT_BACKEND = "django-db"
265 try:
266     CELERY_BROKER_URL = env("CELERY_BROKER_URL")
267 except EnvError:
268     try:
269         # quickfix for Heroku.
270         # See https://github.com/doccano/doccano/issues/1327.
271         uri = env("DATABASE_URL")
272         if uri.startswith("postgres://"):
273             uri = uri.replace("postgres://", "postgresql://", 1)
274         CELERY_BROKER_URL = "sqla+{}".format(uri)
275     except EnvError:
276         CELERY_BROKER_URL = "sqla+sqlite:///{}".format(DATABASES["default"]["NAME"])
277 CELERY_ACCEPT_CONTENT = ["application/json"]
278 CELERY_TASK_SERIALIZER = "json"
279 CELERY_RESULT_SERIALIZER = "json"
280 
281 DEFAULT_AUTO_FIELD = "django.db.models.AutoField"
282
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/backend/config/settings/base.py b/backend/config/settings/base.py
--- a/backend/config/settings/base.py
+++ b/backend/config/settings/base.py
@@ -230,8 +230,9 @@
 ALLOWED_HOSTS = ["*"]
 
 if DEBUG:
-    CORS_ORIGIN_WHITELIST = ("http://127.0.0.1:3000", "http://0.0.0.0:3000", "http://localhost:3000")
-    CSRF_TRUSTED_ORIGINS = CORS_ORIGIN_WHITELIST
+    CORS_ORIGIN_ALLOW_ALL = True
+    CSRF_TRUSTED_ORIGINS = ["http://127.0.0.1:3000", "http://0.0.0.0:3000", "http://localhost:3000"]
+    CSRF_TRUSTED_ORIGINS += env.list("CSRF_TRUSTED_ORIGINS", [])
 
 # Batch size for importing data
 IMPORT_BATCH_SIZE = env.int("IMPORT_BATCH_SIZE", 1000)
diff --git a/backend/config/settings/development.py b/backend/config/settings/development.py
--- a/backend/config/settings/development.py
+++ b/backend/config/settings/development.py
@@ -1,8 +1,6 @@
 from .base import *  # noqa: F403
 
 MIDDLEWARE.append("api.middleware.RangesMiddleware")  # noqa: F405
-CORS_ORIGIN_WHITELIST = ("http://127.0.0.1:3000", "http://0.0.0.0:3000", "http://localhost:3000")
-CSRF_TRUSTED_ORIGINS = CORS_ORIGIN_WHITELIST
 # LOGGING = {
 #     'version': 1,
 #     'handlers': {

{"golden_diff": "diff --git a/backend/config/settings/base.py b/backend/config/settings/base.py\n--- a/backend/config/settings/base.py\n+++ b/backend/config/settings/base.py\n@@ -230,8 +230,9 @@\n ALLOWED_HOSTS = [\"*\"]\n \n if DEBUG:\n-    CORS_ORIGIN_WHITELIST = (\"http://127.0.0.1:3000\", \"http://0.0.0.0:3000\", \"http://localhost:3000\")\n-    CSRF_TRUSTED_ORIGINS = CORS_ORIGIN_WHITELIST\n+    CORS_ORIGIN_ALLOW_ALL = True\n+    CSRF_TRUSTED_ORIGINS = [\"http://127.0.0.1:3000\", \"http://0.0.0.0:3000\", \"http://localhost:3000\"]\n+    CSRF_TRUSTED_ORIGINS += env.list(\"CSRF_TRUSTED_ORIGINS\", [])\n \n # Batch size for importing data\n IMPORT_BATCH_SIZE = env.int(\"IMPORT_BATCH_SIZE\", 1000)\ndiff --git a/backend/config/settings/development.py b/backend/config/settings/development.py\n--- a/backend/config/settings/development.py\n+++ b/backend/config/settings/development.py\n@@ -1,8 +1,6 @@\n from .base import *  # noqa: F403\n \n MIDDLEWARE.append(\"api.middleware.RangesMiddleware\")  # noqa: F405\n-CORS_ORIGIN_WHITELIST = (\"http://127.0.0.1:3000\", \"http://0.0.0.0:3000\", \"http://localhost:3000\")\n-CSRF_TRUSTED_ORIGINS = CORS_ORIGIN_WHITELIST\n # LOGGING = {\n #     'version': 1,\n #     'handlers': {\n", "issue": "CSRF\n![image](https://user-images.githubusercontent.com/20540661/204228990-94d738c9-8bf7-41a9-8b81-d88acaa55148.png)\r\n\n", "before_files": [{"content": "from .base import *  # noqa: F403\n\nMIDDLEWARE.append(\"api.middleware.RangesMiddleware\")  # noqa: F405\nCORS_ORIGIN_WHITELIST = (\"http://127.0.0.1:3000\", \"http://0.0.0.0:3000\", \"http://localhost:3000\")\nCSRF_TRUSTED_ORIGINS = CORS_ORIGIN_WHITELIST\n# LOGGING = {\n#     'version': 1,\n#     'handlers': {\n#         'console': {\n#             'level': 'DEBUG',\n#             'class': 'logging.StreamHandler',\n#         }\n#     },\n#     'loggers': {\n#         'django.db.backends': {\n#             'level': 'DEBUG',\n#             'handlers': ['console'],\n#         },\n#     }\n# }\n", "path": "backend/config/settings/development.py"}, {"content": "\"\"\"\nDjango settings for app project.\n\nFor more information on this file, see\nhttps://docs.djangoproject.com/en/2.0/topics/settings/\n\nFor the full list of settings and their values, see\nhttps://docs.djangoproject.com/en/2.0/ref/settings/\n\nAny setting that is configured via an environment variable may\nalso be set in a `.env` file in the project base directory.\n\"\"\"\nfrom os import path\n\nimport dj_database_url\nfrom environs import Env, EnvError\nfrom furl import furl\n\n# Build paths inside the project like this: path.join(BASE_DIR, ...)\nBASE_DIR = path.dirname(path.dirname(path.dirname(path.abspath(__file__))))\n\nenv = Env()\nenv.read_env(path.join(BASE_DIR, \".env\"), recurse=False)\n\n# Quick-start development settings - unsuitable for production\n# See https://docs.djangoproject.com/en/2.0/howto/deployment/checklist/\n# SECURITY WARNING: keep the secret key used in production secret!\nSECRET_KEY = env(\"SECRET_KEY\", \"v8sk33sy82!uw3ty=!jjv5vp7=s2phrzw(m(hrn^f7e_#1h2al\")\n\n# SECURITY WARNING: don't run with debug turned on in production!\nDEBUG = env.bool(\"DEBUG\", True)\n\n# Application definition\nINSTALLED_APPS = [\n    \"whitenoise.runserver_nostatic\",\n    \"django.contrib.admin\",\n    \"django.contrib.auth\",\n    \"django.contrib.contenttypes\",\n    \"django.contrib.sessions\",\n    \"django.contrib.messages\",\n    \"django.contrib.staticfiles\",\n    \"api\",\n    \"roles\",\n    \"projects\",\n    \"metrics\",\n    \"users\",\n    \"data_import\",\n    \"data_export\",\n    \"auto_labeling\",\n    \"labels\",\n    \"label_types\",\n    \"examples\",\n    \"rest_framework\",\n    \"rest_framework.authtoken\",\n    \"django_filters\",\n    \"polymorphic\",\n    \"corsheaders\",\n    \"drf_yasg\",\n    \"allauth\",\n    \"allauth.account\",\n    \"allauth.socialaccount\",\n    \"dj_rest_auth\",\n    \"dj_rest_auth.registration\",\n    \"django_celery_results\",\n    \"django_drf_filepond\",\n    \"health_check\",\n    \"health_check.cache\",\n    \"health_check.storage\",\n    \"health_check.contrib.migrations\",\n    \"health_check.contrib.celery\",\n    \"django_cleanup\",\n]\n\n\nMIDDLEWARE = [\n    \"django.middleware.security.SecurityMiddleware\",\n    \"whitenoise.middleware.WhiteNoiseMiddleware\",\n    \"django.contrib.sessions.middleware.SessionMiddleware\",\n    \"django.middleware.common.CommonMiddleware\",\n    \"django.middleware.csrf.CsrfViewMiddleware\",\n    \"django.contrib.auth.middleware.AuthenticationMiddleware\",\n    \"django.contrib.messages.middleware.MessageMiddleware\",\n    \"django.middleware.clickjacking.XFrameOptionsMiddleware\",\n    \"corsheaders.middleware.CorsMiddleware\",\n]\n\n\nROOT_URLCONF = \"config.urls\"\nWSGI_APPLICATION = \"config.wsgi.application\"\n\n# Django templates\nTEMPLATES = [\n    {\n        \"BACKEND\": \"django.template.backends.django.DjangoTemplates\",\n        \"DIRS\": [path.join(BASE_DIR, \"client/dist\")],\n        \"APP_DIRS\": True,\n        \"OPTIONS\": {\n            \"context_processors\": [\n                \"django.template.context_processors.debug\",\n                \"django.template.context_processors.request\",\n                \"django.contrib.auth.context_processors.auth\",\n                \"django.contrib.messages.context_processors.messages\",\n            ],\n        },\n    },\n]\n\n# Static files (CSS, JavaScript, Images)\n# https://docs.djangoproject.com/en/2.0/howto/static-files/\nSTATIC_URL = \"/static/\"\nSTATIC_ROOT = path.join(BASE_DIR, \"staticfiles\")\nSTATICFILES_DIRS = [\n    path.join(BASE_DIR, \"client/dist/static\"),\n]\n# STATICFILES_STORAGE = \"whitenoise.storage.CompressedManifestStaticFilesStorage\"\nSTATICFILES_STORAGE = \"whitenoise.storage.CompressedStaticFilesStorage\"\n\n# Auth settings\nAUTHENTICATION_BACKENDS = [\n    \"django.contrib.auth.backends.ModelBackend\",\n]\nHEADER_AUTH_USER_NAME = env(\"HEADER_AUTH_USER_NAME\", \"\")\nHEADER_AUTH_USER_GROUPS = env(\"HEADER_AUTH_USER_GROUPS\", \"\")\nHEADER_AUTH_ADMIN_GROUP_NAME = env(\"HEADER_AUTH_ADMIN_GROUP_NAME\", \"\")\nHEADER_AUTH_GROUPS_SEPERATOR = env(\"HEADER_AUTH_GROUPS_SEPERATOR\", default=\",\")\nif HEADER_AUTH_USER_NAME and HEADER_AUTH_USER_GROUPS and HEADER_AUTH_ADMIN_GROUP_NAME:\n    MIDDLEWARE.append(\"api.middleware.HeaderAuthMiddleware\")\n    AUTHENTICATION_BACKENDS.append(\"django.contrib.auth.backends.RemoteUserBackend\")\n\n# Role settings\nROLE_PROJECT_ADMIN = env(\"ROLE_PROJECT_ADMIN\", \"project_admin\")\nROLE_ANNOTATOR = env(\"ROLE_ANNOTATOR\", \"annotator\")\nROLE_ANNOTATION_APPROVER = env(\"ROLE_ANNOTATION_APPROVER\", \"annotation_approver\")\n\n# Password validation\n# https://docs.djangoproject.com/en/2.0/ref/settings/#auth-password-validators\nAUTH_PASSWORD_VALIDATORS = [\n    {\n        \"NAME\": \"django.contrib.auth.password_validation.UserAttributeSimilarityValidator\",\n    },\n    {\n        \"NAME\": \"django.contrib.auth.password_validation.MinimumLengthValidator\",\n    },\n    {\n        \"NAME\": \"django.contrib.auth.password_validation.CommonPasswordValidator\",\n    },\n    {\n        \"NAME\": \"django.contrib.auth.password_validation.NumericPasswordValidator\",\n    },\n]\n\nREST_FRAMEWORK = {\n    # Use Django's standard `django.contrib.auth` permissions,\n    # or allow read-only access for unauthenticated users.\n    \"DEFAULT_PERMISSION_CLASSES\": [\n        \"rest_framework.permissions.DjangoModelPermissionsOrAnonReadOnly\",\n        \"rest_framework.permissions.IsAuthenticated\",\n    ],\n    \"DEFAULT_AUTHENTICATION_CLASSES\": (\n        \"rest_framework.authentication.SessionAuthentication\",\n        \"rest_framework.authentication.TokenAuthentication\",\n    ),\n    \"DEFAULT_PAGINATION_CLASS\": \"rest_framework.pagination.LimitOffsetPagination\",\n    \"PAGE_SIZE\": env.int(\"DOCCANO_PAGE_SIZE\", default=5),\n    \"DEFAULT_FILTER_BACKENDS\": (\"django_filters.rest_framework.DjangoFilterBackend\",),\n    \"SEARCH_PARAM\": \"q\",\n    \"DEFAULT_RENDERER_CLASSES\": (\n        \"rest_framework.renderers.JSONRenderer\",\n        \"rest_framework.renderers.BrowsableAPIRenderer\",\n        \"rest_framework_xml.renderers.XMLRenderer\",\n    ),\n}\n\n# Internationalization\n# https://docs.djangoproject.com/en/2.0/topics/i18n/\nLANGUAGE_CODE = \"en-us\"\nTIME_ZONE = \"UTC\"\nUSE_I18N = True\nUSE_L10N = True\nUSE_TZ = True\n\n# Testing\nTEST_RUNNER = \"xmlrunner.extra.djangotestrunner.XMLTestRunner\"\nTEST_OUTPUT_DIR = path.join(BASE_DIR, \"junitxml\")\n\nLOGIN_URL = \"/login/\"\nLOGIN_REDIRECT_URL = \"/projects/\"\nLOGOUT_REDIRECT_URL = \"/\"\n\n# Database\n# https://docs.djangoproject.com/en/2.0/ref/settings/#databases\nDATABASES = {\n    \"default\": {\n        \"ENGINE\": \"django.db.backends.sqlite3\",\n        \"NAME\": path.join(BASE_DIR, \"db.sqlite3\"),\n    }\n}\n# Change 'default' database configuration with $DATABASE_URL.\nDATABASES[\"default\"].update(\n    dj_database_url.config(\n        env=\"DATABASE_URL\",\n        conn_max_age=env.int(\"DATABASE_CONN_MAX_AGE\", 500),\n        ssl_require=\"sslmode\" not in furl(env(\"DATABASE_URL\", \"\")).args,\n    )\n)\n\n# work-around for dj-database-url: explicitly disable ssl for sqlite\nif DATABASES[\"default\"].get(\"ENGINE\") == \"django.db.backends.sqlite3\":\n    DATABASES[\"default\"].get(\"OPTIONS\", {}).pop(\"sslmode\", None)\n\n# work-around for dj-database-url: patch ssl for mysql\nif DATABASES[\"default\"].get(\"ENGINE\") == \"django.db.backends.mysql\":\n    DATABASES[\"default\"].get(\"OPTIONS\", {}).pop(\"sslmode\", None)\n    if env(\"MYSQL_SSL_CA\", None):\n        DATABASES[\"default\"].setdefault(\"OPTIONS\", {}).setdefault(\"ssl\", {}).setdefault(\"ca\", env(\"MYSQL_SSL_CA\", None))\n\n# default to a sensible modern driver for Azure SQL\nif DATABASES[\"default\"].get(\"ENGINE\") == \"sql_server.pyodbc\":\n    DATABASES[\"default\"].setdefault(\"OPTIONS\", {}).setdefault(\"driver\", \"ODBC Driver 17 for SQL Server\")\n\n\n# Sessions and CSRF\n# Honor the 'X-Forwarded-Proto' header for request.is_secure()\nSECURE_PROXY_SSL_HEADER = (\"HTTP_X_FORWARDED_PROTO\", \"https\")\nSESSION_COOKIE_SECURE = env.bool(\"SESSION_COOKIE_SECURE\", False)\nCSRF_COOKIE_SECURE = env.bool(\"CSRF_COOKIE_SECURE\", False)\nCSRF_TRUSTED_ORIGINS = env.list(\"CSRF_TRUSTED_ORIGINS\", [])\n\n# Allow all host headers\nALLOWED_HOSTS = [\"*\"]\n\nif DEBUG:\n    CORS_ORIGIN_WHITELIST = (\"http://127.0.0.1:3000\", \"http://0.0.0.0:3000\", \"http://localhost:3000\")\n    CSRF_TRUSTED_ORIGINS = CORS_ORIGIN_WHITELIST\n\n# Batch size for importing data\nIMPORT_BATCH_SIZE = env.int(\"IMPORT_BATCH_SIZE\", 1000)\n\n# Necessary for email verification of new accounts\nEMAIL_USE_TLS = env.bool(\"EMAIL_USE_TLS\", False)\nEMAIL_HOST = env(\"EMAIL_HOST\", None)\nEMAIL_HOST_USER = env(\"EMAIL_HOST_USER\", None)\nEMAIL_HOST_PASSWORD = env(\"EMAIL_HOST_PASSWORD\", None)\nEMAIL_PORT = env.int(\"EMAIL_PORT\", 587)\nDEFAULT_FROM_EMAIL = env(\"DEFAULT_FROM_EMAIL\", \"webmaster@localhost\")\nif not EMAIL_HOST:\n    EMAIL_BACKEND = \"django.core.mail.backends.console.EmailBackend\"\n\n\n# User media files\nMEDIA_ROOT = env(\"MEDIA_ROOT\", path.join(BASE_DIR, \"media\"))\nMEDIA_URL = \"/media/\"\n\n# Filepond settings\nDJANGO_DRF_FILEPOND_UPLOAD_TMP = path.join(BASE_DIR, \"filepond-temp-uploads\")\nDJANGO_DRF_FILEPOND_FILE_STORE_PATH = MEDIA_ROOT\n\n# File upload setting\nMAX_UPLOAD_SIZE = env.int(\"MAX_UPLOAD_SIZE\", pow(1024, 3))  # default: 1GB per a file\nENABLE_FILE_TYPE_CHECK = env.bool(\"ENABLE_FILE_TYPE_CHECK\", False)\n\n# Celery settings\nDJANGO_CELERY_RESULTS_TASK_ID_MAX_LENGTH = 191\nCELERY_RESULT_BACKEND = \"django-db\"\ntry:\n    CELERY_BROKER_URL = env(\"CELERY_BROKER_URL\")\nexcept EnvError:\n    try:\n        # quickfix for Heroku.\n        # See https://github.com/doccano/doccano/issues/1327.\n        uri = env(\"DATABASE_URL\")\n        if uri.startswith(\"postgres://\"):\n            uri = uri.replace(\"postgres://\", \"postgresql://\", 1)\n        CELERY_BROKER_URL = \"sqla+{}\".format(uri)\n    except EnvError:\n        CELERY_BROKER_URL = \"sqla+sqlite:///{}\".format(DATABASES[\"default\"][\"NAME\"])\nCELERY_ACCEPT_CONTENT = [\"application/json\"]\nCELERY_TASK_SERIALIZER = \"json\"\nCELERY_RESULT_SERIALIZER = \"json\"\n\nDEFAULT_AUTO_FIELD = \"django.db.models.AutoField\"\n", "path": "backend/config/settings/base.py"}], "after_files": [{"content": "from .base import *  # noqa: F403\n\nMIDDLEWARE.append(\"api.middleware.RangesMiddleware\")  # noqa: F405\n# LOGGING = {\n#     'version': 1,\n#     'handlers': {\n#         'console': {\n#             'level': 'DEBUG',\n#             'class': 'logging.StreamHandler',\n#         }\n#     },\n#     'loggers': {\n#         'django.db.backends': {\n#             'level': 'DEBUG',\n#             'handlers': ['console'],\n#         },\n#     }\n# }\n", "path": "backend/config/settings/development.py"}, {"content": "\"\"\"\nDjango settings for app project.\n\nFor more information on this file, see\nhttps://docs.djangoproject.com/en/2.0/topics/settings/\n\nFor the full list of settings and their values, see\nhttps://docs.djangoproject.com/en/2.0/ref/settings/\n\nAny setting that is configured via an environment variable may\nalso be set in a `.env` file in the project base directory.\n\"\"\"\nfrom os import path\n\nimport dj_database_url\nfrom environs import Env, EnvError\nfrom furl import furl\n\n# Build paths inside the project like this: path.join(BASE_DIR, ...)\nBASE_DIR = path.dirname(path.dirname(path.dirname(path.abspath(__file__))))\n\nenv = Env()\nenv.read_env(path.join(BASE_DIR, \".env\"), recurse=False)\n\n# Quick-start development settings - unsuitable for production\n# See https://docs.djangoproject.com/en/2.0/howto/deployment/checklist/\n# SECURITY WARNING: keep the secret key used in production secret!\nSECRET_KEY = env(\"SECRET_KEY\", \"v8sk33sy82!uw3ty=!jjv5vp7=s2phrzw(m(hrn^f7e_#1h2al\")\n\n# SECURITY WARNING: don't run with debug turned on in production!\nDEBUG = env.bool(\"DEBUG\", True)\n\n# Application definition\nINSTALLED_APPS = [\n    \"whitenoise.runserver_nostatic\",\n    \"django.contrib.admin\",\n    \"django.contrib.auth\",\n    \"django.contrib.contenttypes\",\n    \"django.contrib.sessions\",\n    \"django.contrib.messages\",\n    \"django.contrib.staticfiles\",\n    \"api\",\n    \"roles\",\n    \"projects\",\n    \"metrics\",\n    \"users\",\n    \"data_import\",\n    \"data_export\",\n    \"auto_labeling\",\n    \"labels\",\n    \"label_types\",\n    \"examples\",\n    \"rest_framework\",\n    \"rest_framework.authtoken\",\n    \"django_filters\",\n    \"polymorphic\",\n    \"corsheaders\",\n    \"drf_yasg\",\n    \"allauth\",\n    \"allauth.account\",\n    \"allauth.socialaccount\",\n    \"dj_rest_auth\",\n    \"dj_rest_auth.registration\",\n    \"django_celery_results\",\n    \"django_drf_filepond\",\n    \"health_check\",\n    \"health_check.cache\",\n    \"health_check.storage\",\n    \"health_check.contrib.migrations\",\n    \"health_check.contrib.celery\",\n    \"django_cleanup\",\n]\n\n\nMIDDLEWARE = [\n    \"django.middleware.security.SecurityMiddleware\",\n    \"whitenoise.middleware.WhiteNoiseMiddleware\",\n    \"django.contrib.sessions.middleware.SessionMiddleware\",\n    \"django.middleware.common.CommonMiddleware\",\n    \"django.middleware.csrf.CsrfViewMiddleware\",\n    \"django.contrib.auth.middleware.AuthenticationMiddleware\",\n    \"django.contrib.messages.middleware.MessageMiddleware\",\n    \"django.middleware.clickjacking.XFrameOptionsMiddleware\",\n    \"corsheaders.middleware.CorsMiddleware\",\n]\n\n\nROOT_URLCONF = \"config.urls\"\nWSGI_APPLICATION = \"config.wsgi.application\"\n\n# Django templates\nTEMPLATES = [\n    {\n        \"BACKEND\": \"django.template.backends.django.DjangoTemplates\",\n        \"DIRS\": [path.join(BASE_DIR, \"client/dist\")],\n        \"APP_DIRS\": True,\n        \"OPTIONS\": {\n            \"context_processors\": [\n                \"django.template.context_processors.debug\",\n                \"django.template.context_processors.request\",\n                \"django.contrib.auth.context_processors.auth\",\n                \"django.contrib.messages.context_processors.messages\",\n            ],\n        },\n    },\n]\n\n# Static files (CSS, JavaScript, Images)\n# https://docs.djangoproject.com/en/2.0/howto/static-files/\nSTATIC_URL = \"/static/\"\nSTATIC_ROOT = path.join(BASE_DIR, \"staticfiles\")\nSTATICFILES_DIRS = [\n    path.join(BASE_DIR, \"client/dist/static\"),\n]\n# STATICFILES_STORAGE = \"whitenoise.storage.CompressedManifestStaticFilesStorage\"\nSTATICFILES_STORAGE = \"whitenoise.storage.CompressedStaticFilesStorage\"\n\n# Auth settings\nAUTHENTICATION_BACKENDS = [\n    \"django.contrib.auth.backends.ModelBackend\",\n]\nHEADER_AUTH_USER_NAME = env(\"HEADER_AUTH_USER_NAME\", \"\")\nHEADER_AUTH_USER_GROUPS = env(\"HEADER_AUTH_USER_GROUPS\", \"\")\nHEADER_AUTH_ADMIN_GROUP_NAME = env(\"HEADER_AUTH_ADMIN_GROUP_NAME\", \"\")\nHEADER_AUTH_GROUPS_SEPERATOR = env(\"HEADER_AUTH_GROUPS_SEPERATOR\", default=\",\")\nif HEADER_AUTH_USER_NAME and HEADER_AUTH_USER_GROUPS and HEADER_AUTH_ADMIN_GROUP_NAME:\n    MIDDLEWARE.append(\"api.middleware.HeaderAuthMiddleware\")\n    AUTHENTICATION_BACKENDS.append(\"django.contrib.auth.backends.RemoteUserBackend\")\n\n# Role settings\nROLE_PROJECT_ADMIN = env(\"ROLE_PROJECT_ADMIN\", \"project_admin\")\nROLE_ANNOTATOR = env(\"ROLE_ANNOTATOR\", \"annotator\")\nROLE_ANNOTATION_APPROVER = env(\"ROLE_ANNOTATION_APPROVER\", \"annotation_approver\")\n\n# Password validation\n# https://docs.djangoproject.com/en/2.0/ref/settings/#auth-password-validators\nAUTH_PASSWORD_VALIDATORS = [\n    {\n        \"NAME\": \"django.contrib.auth.password_validation.UserAttributeSimilarityValidator\",\n    },\n    {\n        \"NAME\": \"django.contrib.auth.password_validation.MinimumLengthValidator\",\n    },\n    {\n        \"NAME\": \"django.contrib.auth.password_validation.CommonPasswordValidator\",\n    },\n    {\n        \"NAME\": \"django.contrib.auth.password_validation.NumericPasswordValidator\",\n    },\n]\n\nREST_FRAMEWORK = {\n    # Use Django's standard `django.contrib.auth` permissions,\n    # or allow read-only access for unauthenticated users.\n    \"DEFAULT_PERMISSION_CLASSES\": [\n        \"rest_framework.permissions.DjangoModelPermissionsOrAnonReadOnly\",\n        \"rest_framework.permissions.IsAuthenticated\",\n    ],\n    \"DEFAULT_AUTHENTICATION_CLASSES\": (\n        \"rest_framework.authentication.SessionAuthentication\",\n        \"rest_framework.authentication.TokenAuthentication\",\n    ),\n    \"DEFAULT_PAGINATION_CLASS\": \"rest_framework.pagination.LimitOffsetPagination\",\n    \"PAGE_SIZE\": env.int(\"DOCCANO_PAGE_SIZE\", default=5),\n    \"DEFAULT_FILTER_BACKENDS\": (\"django_filters.rest_framework.DjangoFilterBackend\",),\n    \"SEARCH_PARAM\": \"q\",\n    \"DEFAULT_RENDERER_CLASSES\": (\n        \"rest_framework.renderers.JSONRenderer\",\n        \"rest_framework.renderers.BrowsableAPIRenderer\",\n        \"rest_framework_xml.renderers.XMLRenderer\",\n    ),\n}\n\n# Internationalization\n# https://docs.djangoproject.com/en/2.0/topics/i18n/\nLANGUAGE_CODE = \"en-us\"\nTIME_ZONE = \"UTC\"\nUSE_I18N = True\nUSE_L10N = True\nUSE_TZ = True\n\n# Testing\nTEST_RUNNER = \"xmlrunner.extra.djangotestrunner.XMLTestRunner\"\nTEST_OUTPUT_DIR = path.join(BASE_DIR, \"junitxml\")\n\nLOGIN_URL = \"/login/\"\nLOGIN_REDIRECT_URL = \"/projects/\"\nLOGOUT_REDIRECT_URL = \"/\"\n\n# Database\n# https://docs.djangoproject.com/en/2.0/ref/settings/#databases\nDATABASES = {\n    \"default\": {\n        \"ENGINE\": \"django.db.backends.sqlite3\",\n        \"NAME\": path.join(BASE_DIR, \"db.sqlite3\"),\n    }\n}\n# Change 'default' database configuration with $DATABASE_URL.\nDATABASES[\"default\"].update(\n    dj_database_url.config(\n        env=\"DATABASE_URL\",\n        conn_max_age=env.int(\"DATABASE_CONN_MAX_AGE\", 500),\n        ssl_require=\"sslmode\" not in furl(env(\"DATABASE_URL\", \"\")).args,\n    )\n)\n\n# work-around for dj-database-url: explicitly disable ssl for sqlite\nif DATABASES[\"default\"].get(\"ENGINE\") == \"django.db.backends.sqlite3\":\n    DATABASES[\"default\"].get(\"OPTIONS\", {}).pop(\"sslmode\", None)\n\n# work-around for dj-database-url: patch ssl for mysql\nif DATABASES[\"default\"].get(\"ENGINE\") == \"django.db.backends.mysql\":\n    DATABASES[\"default\"].get(\"OPTIONS\", {}).pop(\"sslmode\", None)\n    if env(\"MYSQL_SSL_CA\", None):\n        DATABASES[\"default\"].setdefault(\"OPTIONS\", {}).setdefault(\"ssl\", {}).setdefault(\"ca\", env(\"MYSQL_SSL_CA\", None))\n\n# default to a sensible modern driver for Azure SQL\nif DATABASES[\"default\"].get(\"ENGINE\") == \"sql_server.pyodbc\":\n    DATABASES[\"default\"].setdefault(\"OPTIONS\", {}).setdefault(\"driver\", \"ODBC Driver 17 for SQL Server\")\n\n\n# Sessions and CSRF\n# Honor the 'X-Forwarded-Proto' header for request.is_secure()\nSECURE_PROXY_SSL_HEADER = (\"HTTP_X_FORWARDED_PROTO\", \"https\")\nSESSION_COOKIE_SECURE = env.bool(\"SESSION_COOKIE_SECURE\", False)\nCSRF_COOKIE_SECURE = env.bool(\"CSRF_COOKIE_SECURE\", False)\nCSRF_TRUSTED_ORIGINS = env.list(\"CSRF_TRUSTED_ORIGINS\", [])\n\n# Allow all host headers\nALLOWED_HOSTS = [\"*\"]\n\nif DEBUG:\n    CORS_ORIGIN_ALLOW_ALL = True\n    CSRF_TRUSTED_ORIGINS = [\"http://127.0.0.1:3000\", \"http://0.0.0.0:3000\", \"http://localhost:3000\"]\n    CSRF_TRUSTED_ORIGINS += env.list(\"CSRF_TRUSTED_ORIGINS\", [])\n\n# Batch size for importing data\nIMPORT_BATCH_SIZE = env.int(\"IMPORT_BATCH_SIZE\", 1000)\n\n# Necessary for email verification of new accounts\nEMAIL_USE_TLS = env.bool(\"EMAIL_USE_TLS\", False)\nEMAIL_HOST = env(\"EMAIL_HOST\", None)\nEMAIL_HOST_USER = env(\"EMAIL_HOST_USER\", None)\nEMAIL_HOST_PASSWORD = env(\"EMAIL_HOST_PASSWORD\", None)\nEMAIL_PORT = env.int(\"EMAIL_PORT\", 587)\nDEFAULT_FROM_EMAIL = env(\"DEFAULT_FROM_EMAIL\", \"webmaster@localhost\")\nif not EMAIL_HOST:\n    EMAIL_BACKEND = \"django.core.mail.backends.console.EmailBackend\"\n\n\n# User media files\nMEDIA_ROOT = env(\"MEDIA_ROOT\", path.join(BASE_DIR, \"media\"))\nMEDIA_URL = \"/media/\"\n\n# Filepond settings\nDJANGO_DRF_FILEPOND_UPLOAD_TMP = path.join(BASE_DIR, \"filepond-temp-uploads\")\nDJANGO_DRF_FILEPOND_FILE_STORE_PATH = MEDIA_ROOT\n\n# File upload setting\nMAX_UPLOAD_SIZE = env.int(\"MAX_UPLOAD_SIZE\", pow(1024, 3))  # default: 1GB per a file\nENABLE_FILE_TYPE_CHECK = env.bool(\"ENABLE_FILE_TYPE_CHECK\", False)\n\n# Celery settings\nDJANGO_CELERY_RESULTS_TASK_ID_MAX_LENGTH = 191\nCELERY_RESULT_BACKEND = \"django-db\"\ntry:\n    CELERY_BROKER_URL = env(\"CELERY_BROKER_URL\")\nexcept EnvError:\n    try:\n        # quickfix for Heroku.\n        # See https://github.com/doccano/doccano/issues/1327.\n        uri = env(\"DATABASE_URL\")\n        if uri.startswith(\"postgres://\"):\n            uri = uri.replace(\"postgres://\", \"postgresql://\", 1)\n        CELERY_BROKER_URL = \"sqla+{}\".format(uri)\n    except EnvError:\n        CELERY_BROKER_URL = \"sqla+sqlite:///{}\".format(DATABASES[\"default\"][\"NAME\"])\nCELERY_ACCEPT_CONTENT = [\"application/json\"]\nCELERY_TASK_SERIALIZER = \"json\"\nCELERY_RESULT_SERIALIZER = \"json\"\n\nDEFAULT_AUTO_FIELD = \"django.db.models.AutoField\"\n", "path": "backend/config/settings/base.py"}]}