""" Django settings for nyanzamarket project. """ import os from pathlib import Path from datetime import timedelta from dotenv import load_dotenv # Load environment variables load_dotenv() # Build paths inside the project like this: BASE_DIR / 'subdir'. BASE_DIR = Path(__file__).resolve().parent.parent # Quick-start development settings - unsuitable for production SECRET_KEY = os.getenv('SECRET_KEY', 'django-insecure-change-this-in-production') DEBUG = os.getenv('DEBUG', 'True').lower() == 'true' ALLOWED_HOSTS = [ 'api.isoftke.com', 'isoftke.com', 'localhost', '127.0.0.1', ] # Application definition INSTALLED_APPS = [ "django.contrib.auth", "django.contrib.contenttypes", "django.contrib.sessions", "django.contrib.sitemaps", "django.contrib.messages", "django.contrib.staticfiles", "django.contrib.sites", # Third party apps "rest_framework", "rest_framework_simplejwt", "rest_framework_simplejwt.token_blacklist", "corsheaders", # Local apps "accounts", "products", "payments", "chat", "notifications", "pos", "promotions", "stories", "markets", "blog", "groups", "videos", "live", "ai_chat", "services", "events", "menus", "orders", "team", ] MIDDLEWARE = [ "corsheaders.middleware.CorsMiddleware", "django.middleware.security.SecurityMiddleware", "django.contrib.sessions.middleware.SessionMiddleware", "django.middleware.common.CommonMiddleware", "django.middleware.csrf.CsrfViewMiddleware", "django.contrib.auth.middleware.AuthenticationMiddleware", "django.contrib.messages.middleware.MessageMiddleware", "django.middleware.clickjacking.XFrameOptionsMiddleware", ] SITE_ID = 1 ROOT_URLCONF = "nyanzamarket.urls" TEMPLATES = [ { "BACKEND": "django.template.backends.django.DjangoTemplates", "DIRS": [BASE_DIR / "templates"], "APP_DIRS": True, "OPTIONS": { "context_processors": [ "django.template.context_processors.request", "django.contrib.auth.context_processors.auth", "django.contrib.messages.context_processors.messages", ], }, }, ] WSGI_APPLICATION = "nyanzamarket.wsgi.application" # Database (SQLite for development) # DATABASES = { # "default": { # "ENGINE": "django.db.backends.sqlite3", # "NAME": BASE_DIR / "db.sqlite3", # } # } # PostgreSQL (uncomment below and comment out SQLite above when ready) DATABASES = { "default": { "ENGINE": "django.db.backends.postgresql", "NAME": os.environ.get("POSTGRES_DB", "vdpyugbe_ianslayer"), "USER": os.environ.get("POSTGRES_USER", "vdpyugbe_cherylaianmhe"), "PASSWORD": os.environ.get("POSTGRES_PASSWORD", "aZ6_pW3=UE48"), "HOST": os.environ.get("POSTGRES_HOST", "localhost"), "PORT": os.environ.get("POSTGRES_PORT", "5432"), } } # Password validation AUTH_PASSWORD_VALIDATORS = [ { "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator", }, { "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator", }, { "NAME": "django.contrib.auth.password_validation.CommonPasswordValidator", }, { "NAME": "django.contrib.auth.password_validation.NumericPasswordValidator", }, ] # Internationalization LANGUAGE_CODE = "en-us" TIME_ZONE = "Africa/Nairobi" USE_I18N = True USE_TZ = True # Static files (CSS, JavaScript, Images) STATIC_URL = "static/" STATIC_ROOT = BASE_DIR / "staticfiles" # Media files (uploads) MEDIA_URL = "/media/" MEDIA_ROOT = BASE_DIR / "media" # Default primary key field type DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField" # Custom User Model AUTH_USER_MODEL = "accounts.User" # Email Configuration EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend' EMAIL_HOST = os.getenv('EMAIL_HOST', 'premium287.web-hosting.com') EMAIL_PORT = int(os.getenv('EMAIL_PORT', 465)) EMAIL_HOST_USER = os.getenv('EMAIL_HOST_USER', 'info@nyanzamarket.com') EMAIL_HOST_PASSWORD = os.getenv('EMAIL_HOST_PASSWORD', '') EMAIL_USE_SSL = os.getenv('EMAIL_USE_SSL', 'True').lower() == 'true' EMAIL_USE_TLS = False DEFAULT_FROM_EMAIL = os.getenv('DEFAULT_FROM_EMAIL', 'NyanzaMarket ') # Frontend URL for email links FRONTEND_URL = os.getenv('FRONTEND_URL', 'http://localhost:5173') # M-Pesa Settings MPESA_SANDBOX = os.getenv('MPESA_SANDBOX', 'False').lower() == 'true' MPESA_ENCRYPTION_KEY = os.getenv('MPESA_ENCRYPTION_KEY', SECRET_KEY[:32]) MPESA_CALLBACK_URL = os.getenv('MPESA_CALLBACK_URL', 'https://api.isoftke.com/api/payments/mpesa/callback/') # Django REST Framework settings REST_FRAMEWORK = { 'DEFAULT_AUTHENTICATION_CLASSES': ( 'rest_framework_simplejwt.authentication.JWTAuthentication', ), 'DEFAULT_PERMISSION_CLASSES': ( 'rest_framework.permissions.IsAuthenticated', ), 'DEFAULT_PARSER_CLASSES': ( 'rest_framework.parsers.JSONParser', 'rest_framework.parsers.MultiPartParser', 'rest_framework.parsers.FormParser', ), } # JWT Settings SIMPLE_JWT = { 'ACCESS_TOKEN_LIFETIME': timedelta(days=int(os.getenv('JWT_ACCESS_TOKEN_LIFETIME_DAYS', 1))), 'REFRESH_TOKEN_LIFETIME': timedelta(days=int(os.getenv('JWT_REFRESH_TOKEN_LIFETIME_DAYS', 7))), 'ROTATE_REFRESH_TOKENS': True, 'BLACKLIST_AFTER_ROTATION': True, 'UPDATE_LAST_LOGIN': True, 'ALGORITHM': 'HS256', 'SIGNING_KEY': SECRET_KEY, 'AUTH_HEADER_TYPES': ('Bearer',), 'AUTH_HEADER_NAME': 'HTTP_AUTHORIZATION', 'USER_ID_FIELD': 'id', 'USER_ID_CLAIM': 'user_id', } CORS_ALLOWED_ORIGINS = [ "https://wananchimart.com", "https://www.wananchimart.com", "https://isoftke.com", "http://localhost:5173", "http://127.0.0.1:5173", "http://localhost:3000", "http://127.0.0.1:3000", "http://localhost:8080", "http://127.0.0.1:8080", # Capacitor mobile app origins "capacitor://localhost", "http://localhost", "https://localhost", "ionic://localhost", "http://192.168.0.1", ] # For mobile apps that may send null/no origin CORS_ALLOW_ALL_ORIGINS = False # Allow requests with no Origin header (mobile apps sometimes don't send one) CORS_ORIGIN_ALLOW_ALL = False CORS_ORIGIN_WHITELIST = CORS_ALLOWED_ORIGINS # Regex patterns for origins (catches variations) CORS_ALLOWED_ORIGIN_REGEXES = [ r"^https?://localhost(:\d+)?$", r"^https?://127\.0\.0\.1(:\d+)?$", r"^capacitor://.*$", r"^ionic://.*$", r"^http://192\.168\.\d+\.\d+(:\d+)?$", ] CORS_ALLOW_CREDENTIALS = True # Google OAuth Settings GOOGLE_CLIENT_ID = os.getenv('GOOGLE_CLIENT_ID', '') CORS_ALLOW_HEADERS = [ 'accept', 'accept-encoding', 'authorization', 'content-type', 'dnt', 'origin', 'user-agent', 'x-csrftoken', 'x-requested-with', ] CORS_ALLOW_METHODS = [ 'DELETE', 'GET', 'OPTIONS', 'PATCH', 'POST', 'PUT', ] # Redis Cache CACHES = { "default": { "BACKEND": "django_redis.cache.RedisCache", "LOCATION": os.getenv("REDIS_URL", "redis://127.0.0.1:6379/0"), "OPTIONS": { "CLIENT_CLASS": "django_redis.client.DefaultClient", }, "KEY_PREFIX": "nyanza", "TIMEOUT": 300, # 5 minutes default } } # Use Redis for sessions too SESSION_ENGINE = "django.contrib.sessions.backends.cache" SESSION_CACHE_ALIAS = "default" # OTP Settings OTP_EXPIRY_MINUTES = 10 OTP_LENGTH = 6 # Paystack Settings PAYSTACK_SECRET_KEY = 'sk_live_1eebefe35902c9fae68e5a5d7afad0f2782e18d9' PAYSTACK_PUBLIC_KEY = 'pk_live_cdf0dad3a3af640e5ad40a8ed9e03b033f6ac268' PAYSTACK_BASE_URL = 'https://api.paystack.co' # Upgrade Price (in Kobo for Paystack - 1 KES = 100 Kobo equivalent) VENDOR_UPGRADE_PRICE = 99900 # KES 999 in kobo VENDOR_VERIFICATION_PRICE = 50000 # KES 500 in kobo # CSRF Trusted Origins (required for production with HTTPS) CSRF_TRUSTED_ORIGINS = [ "https://api.isoftke.com", "https://wananchimart.com", "https://www.wananchimart.com", ] # Agora Settings (Live Streaming) AGORA_APP_ID = os.getenv('AGORA_APP_ID', '') AGORA_APP_CERTIFICATE = os.getenv('AGORA_APP_CERTIFICATE', '') # Production Security Settings if not DEBUG: SECURE_SSL_REDIRECT = False # Let Nginx/hosting handle SSL redirect SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https') SESSION_COOKIE_SECURE = True CSRF_COOKIE_SECURE = True SECURE_BROWSER_XSS_FILTER = True SECURE_CONTENT_TYPE_NOSNIFF = True X_FRAME_OPTIONS = 'DENY'