10xgraph-api 0.7.0__py3-none-any.whl

tenxgraph_api/src/app/core/config/settings.py

@@ -0,0 +1,202 @@
+import logging
+import os
+from functools import lru_cache
+
+from pydantic import ConfigDict, Field, field_validator, model_validator
+from pydantic_settings import BaseSettings
+
+
+IS_PRODUCTION = False
+LOGGER_NAME = os.getenv("LOGGER_NAME", "10xgraph-api")
+
+logger = logging.getLogger(LOGGER_NAME)
+
+
+class Settings(BaseSettings):
+    """
+    This class defines the configuration settings for the application.
+
+    Attributes:
+        APP_NAME (str): The name of the application.
+        APP_VERSION (str): The version of the application.
+        MODE (str): The mode in which the application is running (e.g., development, production).
+        LOG_LEVEL (int): The logging level for the application.
+        SUMMARY (str): A brief summary of the application. Default is "Backend Base".
+
+        ORIGINS (str): CORS allowed origins.
+        ALLOWED_HOST (str): CORS allowed hosts.
+        REDIS_URL (str): The URL for the Redis server.
+
+        SENTRY_DSN (str): The DSN for Sentry error tracking.
+
+    Config:
+        extra (str): Configuration for handling extra fields. Default is "allow".
+    """
+
+    APP_NAME: str = "MyApp"
+    APP_VERSION: str = "0.1.0"
+    MODE: str = "development"
+    # CRITICAL = 50
+    # FATAL = CRITICAL
+    # ERROR = 40
+    # WARNING = 30
+    # WARN = WARNING
+    # INFO = 20
+    # DEBUG = 10
+    # NOTSET = 0
+    LOG_LEVEL: str = "INFO"
+    IS_DEBUG: bool = True
+
+    #################################
+    ###### Request Limits ###########
+    #################################
+    MAX_REQUEST_SIZE: int = 10 * 1024 * 1024  # 10MB default
+
+    #################################
+    ###### Security Headers #########
+    #################################
+    SECURITY_HEADERS_ENABLED: bool = True
+    HSTS_ENABLED: bool = True
+    HSTS_MAX_AGE: int = 31536000  # 1 year in seconds
+    HSTS_INCLUDE_SUBDOMAINS: bool = True
+    HSTS_PRELOAD: bool = False
+    FRAME_OPTIONS: str = "DENY"  # DENY, SAMEORIGIN, or ALLOW-FROM
+    CONTENT_TYPE_OPTIONS: str = "nosniff"
+    XSS_PROTECTION: str = "1; mode=block"
+    REFERRER_POLICY: str = "strict-origin-when-cross-origin"
+    PERMISSIONS_POLICY: str | None = None  # Uses default if None
+    CSP_POLICY: str | None = None  # Uses default if None
+
+    SUMMARY: str = "10xGraph Backend"
+
+    #################################
+    ###### CORS Config ##############
+    #################################
+    ORIGINS: str = "*"
+    ALLOWED_HOST: str = "*"
+    # Whether cross-origin requests may carry credentials (cookies / auth headers).
+    #
+    # Combined with ORIGINS="*" this is the dangerous case: Starlette reflects the
+    # request's Origin back with Access-Control-Allow-Credentials: true, which
+    # effectively makes EVERY origin a trusted, credentialed origin. In production
+    # that combination is refused at startup (see setup_middleware); set explicit
+    # ORIGINS, or set CORS_ALLOW_CREDENTIALS=false to serve a public,
+    # non-credentialed API from any origin.
+    CORS_ALLOW_CREDENTIALS: bool = True
+
+    #################################
+    ###### Paths ####################
+    #################################
+    ROOT_PATH: str = "/"
+    DOCS_PATH: str = "/docs"
+    REDOCS_PATH: str = "/redocs"
+
+    #################################
+    ###### REDIS Config ##########
+    #################################
+    REDIS_URL: str | None = None
+
+    #################################
+    ###### sentry Config ############
+    #################################
+    SENTRY_DSN: str | None = None
+    # Share of requests traced / profiled. 1.0 sends every request, which is costly and
+    # rarely wanted in production.
+    SENTRY_TRACES_SAMPLE_RATE: float = Field(default=0.1, ge=0.0, le=1.0)
+    SENTRY_PROFILES_SAMPLE_RATE: float = Field(default=0.0, ge=0.0, le=1.0)
+
+    #################################
+    ###### Auth ############
+    #################################
+    SNOWFLAKE_EPOCH: int = 1609459200000
+    SNOWFLAKE_NODE_ID: int = 1
+    SNOWFLAKE_WORKER_ID: int = 2
+    SNOWFLAKE_TIME_BITS: int = 39
+    SNOWFLAKE_NODE_BITS: int = 5
+    SNOWFLAKE_WORKER_BITS: int = 8
+
+    #################################
+    ###### JWT Config ###############
+    #################################
+    JWT_SECRET_KEY: str | None = None
+    JWT_ALGORITHM: str = "HS256"
+    # When set, tokens must carry a matching ``iss`` / ``aud`` claim, so a token minted for
+    # another service that shares the signing key is not accepted here.
+    JWT_ISSUER: str | None = None
+    JWT_AUDIENCE: str | None = None
+
+    #################################
+    ###### OTEL Config ##############
+    #################################
+    OTEL_ENABLED: bool = False
+    OTEL_SERVICE_NAME: str = "10xgraph-api"
+    OTEL_EXPORTER_OTLP_ENDPOINT: str | None = None
+    OTEL_LEVEL: str = "standard"  # spans | standard | full
+
+    @field_validator("MODE", mode="before")
+    @classmethod
+    def normalize_mode(cls, v: str | None) -> str:
+        """Normalize MODE to lowercase."""
+        return v.lower() if v else "development"
+
+    @field_validator("ORIGINS")
+    @classmethod
+    def warn_cors_wildcard(cls, v: str) -> str:
+        """Warn if CORS is set to wildcard in production."""
+        mode = os.environ.get("MODE", "development").lower()
+        if v == "*" and mode == "production":
+            logger.warning(
+                "⚠️  SECURITY WARNING: CORS ORIGINS='*' in production.\n"
+                "   This allows any website to make requests to your API.\n"
+                "   Set ORIGINS to specific domains (e.g., https://yourdomain.com)"
+            )
+        return v
+
+    @model_validator(mode="after")
+    def check_production_security(self):
+        """Check for insecure configurations in production mode."""
+        if self.MODE == "production":
+            # Docs (and the OpenAPI schema behind them) are off in production unless a path
+            # was set explicitly.
+            for field in ("DOCS_PATH", "REDOCS_PATH"):
+                if field not in self.model_fields_set:
+                    setattr(self, field, "")
+
+            warnings = []
+
+            if self.IS_DEBUG:
+                warnings.append(
+                    "⚠️  DEBUG mode is enabled in production. This may expose sensitive information."
+                )
+
+            if self.DOCS_PATH or self.REDOCS_PATH:
+                warnings.append(
+                    "⚠️  API documentation endpoints are enabled in production. "
+                    "Consider disabling DOCS_PATH and REDOCS_PATH."
+                )
+
+            if self.ALLOWED_HOST == "*":
+                warnings.append(
+                    "⚠️  ALLOWED_HOST='*' in production. "
+                    "Set to specific hostnames for better security."
+                )
+
+            if warnings:
+                logger.warning("\n".join(["\n🔒 PRODUCTION SECURITY WARNINGS:", *warnings]))
+
+        return self
+
+    model_config = ConfigDict(extra="allow")
+
+
+@lru_cache
+def get_settings() -> Settings:
+    """
+    Retrieve and return the application settings.
+    If not in production, load settings from a specific environment file.
+    Returns:
+        Settings: An instance of the Settings class containing
+        application configurations.
+    """
+    logger.info("Loading settings from environment variables and .env if present")
+    return Settings()  # type: ignore

tenxgraph_api/src/app/core/config/setup_logs.py

@@ -0,0 +1,65 @@
+import logging
+import sys
+
+from fastapi.logger import logger as fastapi_logger
+
+from tenxgraph_api.src.app.core.config.settings import LOGGER_NAME
+from tenxgraph_api.src.app.core.utils.log_sanitizer import SanitizingFormatter
+
+
+# Top-level names of the loggers the API server writes to; children ("tenxgraph_api.media",
+# "tenxgraph_api.rate_limit", ...) reach these handlers through propagation.
+APP_LOGGER_NAMES = (LOGGER_NAME, "10xgraph-api", "tenxgraph_api", "tenxgraph_api")
+
+
+def init_logger(level: int | str = logging.INFO) -> None:
+    """
+    Initializes and configures logging for the application.
+
+    This function sets up various loggers used in the application, including
+    those for Gunicorn, Uvicorn, FastAPI, database clients, Tortoise ORM, and
+    custom loggers. It also configures a console handler to output logs to
+    stdout.
+
+    Args:
+        level (int): The logging level to set for the loggers.
+    """
+    # GCLOUD SETUP
+    # client = Client()
+    # client.get_default_handler()
+    # client.setup_logging()
+
+    # setup logging
+    gunicorn_error_logger = logging.getLogger("gunicorn.error")
+    # gunicorn_logger = logging.getLogger("gunicorn")
+    uvicorn_access_logger = logging.getLogger("uvicorn.access")
+    uvicorn_access_logger.handlers = gunicorn_error_logger.handlers
+    fastapi_logger.handlers = gunicorn_error_logger.handlers
+    fastapi_logger.setLevel(level)
+
+    # Create console handler and set level to DEBUG
+    console_handler = logging.StreamHandler(sys.stdout)
+    console_handler.setLevel(level)
+
+    # Create formatter
+    base_formatter = logging.Formatter(
+        "%(asctime)s - %(name)s - %(levelname)s - %(filename)s:%(lineno)d - %(message)s"
+    )
+    # Wrap with sanitizing formatter to prevent sensitive data in logs
+    formatter = SanitizingFormatter(base_formatter)
+
+    # Add formatter to console handler
+    console_handler.setFormatter(formatter)
+    # Add console handler to logger
+    fastapi_logger.addHandler(console_handler)
+
+    # Route application loggers through the same sanitizing console handler. They stop
+    # propagating so an unsanitized copy does not also reach the root (or last-resort) handler.
+    for logger_name in dict.fromkeys(APP_LOGGER_NAMES):
+        app_logger = logging.getLogger(logger_name)
+        app_logger.setLevel(level)
+        for handler in list(app_logger.handlers):
+            if isinstance(handler.formatter, SanitizingFormatter):
+                app_logger.removeHandler(handler)  # init_logger may run more than once
+        app_logger.addHandler(console_handler)
+        app_logger.propagate = False