django-cfg 1.4.46__py3-none-any.whl → 1.5.181__py3-none-any.whl

django_cfg/apps/system/frontend/utils/spa_path_resolver.py

@@ -0,0 +1,94 @@
+"""
+SPA Path Resolver Utility
+
+Resolves paths for Single Page Application (SPA) routing with multiple fallback strategies.
+Used for Next.js static export where client-side routing handles unknown routes.
+"""
+
+import logging
+from pathlib import Path
+
+logger = logging.getLogger(__name__)
+
+
+def resolve_spa_path(base_dir: Path, path: str) -> str:
+    """
+    Resolve SPA path with multiple fallback strategies.
+    
+    Resolution order:
+    1. Exact file match (e.g., script.js, style.css)
+    2. path/index.html (e.g., private/centrifugo/index.html)
+    3. path.html (e.g., private.html for /private)
+    4. Fallback to root index.html for SPA routing
+    
+    Args:
+        base_dir: Base directory for static files
+        path: Requested path (e.g., '/private/centrifugo' or 'private/centrifugo')
+        
+    Returns:
+        str: Resolved file path relative to base_dir
+        
+    Examples:
+        >>> from pathlib import Path
+        >>> base_dir = Path('/path/to/static')
+        >>> resolve_spa_path(base_dir, '/private/centrifugo')
+        'private/centrifugo/index.html'
+        >>> resolve_spa_path(base_dir, '/private')
+        'private.html'
+        >>> resolve_spa_path(base_dir, '/_next/static/chunk.js')
+        '_next/static/chunk.js'
+        >>> resolve_spa_path(base_dir, '/unknown/route')
+        'index.html'
+    """
+    file_path = base_dir / path
+    
+    # Remove trailing slash for processing
+    path_normalized = path.lstrip('/').rstrip('/')
+    
+    # Strategy 1: Exact file match (for static assets like JS, CSS, images)
+    if file_path.exists() and file_path.is_file():
+        logger.debug(f"[SPA Router] Exact match: {path}")
+        return path.lstrip('/')
+    
+    # Strategy 2: Try path/index.html (most common for SPA routes)
+    index_in_dir = base_dir / path_normalized / 'index.html'
+    if index_in_dir.exists():
+        resolved_path = f"{path_normalized}/index.html"
+        logger.debug(f"[SPA Router] Resolved {path} → {resolved_path}")
+        return resolved_path
+    
+    # Strategy 3: Try with trailing slash + index.html
+    if path.endswith('/'):
+        index_path = path_normalized + '/index.html'
+        if (base_dir / index_path).exists():
+            logger.debug(f"[SPA Router] Trailing slash resolved: {index_path}")
+            return index_path
+    
+    # Strategy 4: Try path.html (Next.js static export behavior)
+    html_file = base_dir / (path_normalized + '.html')
+    if html_file.exists():
+        resolved_path = path_normalized + '.html'
+        logger.debug(f"[SPA Router] HTML file match: {resolved_path}")
+        return resolved_path
+    
+    # Strategy 5: Check if it's a directory without index.html
+    normalized_file_path = base_dir / path_normalized
+    if normalized_file_path.exists() and normalized_file_path.is_dir():
+        # Try index.html in that directory
+        index_in_existing_dir = normalized_file_path / 'index.html'
+        if index_in_existing_dir.exists():
+            resolved_path = f"{path_normalized}/index.html"
+            logger.debug(f"[SPA Router] Directory with index: {resolved_path}")
+            return resolved_path
+    
+    # Strategy 6: SPA fallback - serve root index.html
+    # This allows client-side routing to handle unknown routes
+    root_index = base_dir / 'index.html'
+    if root_index.exists():
+        logger.debug(f"[SPA Router] Fallback to index.html for route: {path}")
+        return 'index.html'
+    
+    # Strategy 7: Nothing found - return original path (will 404)
+    logger.warning(f"[SPA Router] No match found for: {path}")
+    return path.lstrip('/')
+

django_cfg/apps/system/frontend/views.py

@@ -0,0 +1,270 @@
+"""Views for serving Next.js static builds with automatic JWT injection.
+
+JWT tokens are automatically injected into HTML responses for authenticated users.
+This is specific to Next.js frontend apps only.
+
+Features:
+- Automatic extraction of ZIP archives with metadata comparison (size + mtime)
+- Auto-reextraction when ZIP content changes (size or timestamp)
+- Marker file (.zip_meta) tracks ZIP metadata for reliable comparison
+- Cache busting (no-store headers for HTML)
+- SPA routing with fallback strategies
+- JWT token injection for authenticated users
+"""
+
+import logging
+import zipfile
+import shutil
+from pathlib import Path
+from datetime import datetime, timedelta
+from django.http import Http404, HttpResponse, FileResponse
+from django.views.static import serve
+from django.views import View
+from django.views.decorators.clickjacking import xframe_options_exempt
+from django.utils.decorators import method_decorator
+from django.shortcuts import render, redirect
+from django.contrib.auth.mixins import UserPassesTestMixin
+
+from .utils import (
+    fix_html_links_after_extraction,
+    resolve_spa_path,
+    find_precompressed_file,
+    should_inject_jwt,
+    inject_jwt_tokens,
+    convert_file_response_to_http_response,
+    ensure_frontend_asset,
+)
+
+logger = logging.getLogger(__name__)
+
+
+class ZipExtractionMixin:
+    """
+    Mixin for automatic ZIP extraction with metadata-based refresh.
+
+    Provides intelligent ZIP archive handling:
+    - Auto-extraction when directory doesn't exist
+    - Auto-reextraction when ZIP metadata changes (size or mtime)
+    - Marker file (.zip_meta) tracks ZIP state for reliable comparison
+    - Works correctly in Docker where timestamps can be misleading
+
+    Usage:
+        class MyView(ZipExtractionMixin, View):
+            app_name = 'myapp'  # Will look for myapp.zip
+    """
+
+    def extract_zip_if_needed(self, base_dir: Path, zip_path: Path, app_name: str) -> bool:
+        """
+        Extract ZIP archive if needed based on ZIP metadata (size + mtime) comparison.
+
+        Logic:
+        1. If directory doesn't exist → extract
+        2. If marker file doesn't exist → extract
+        3. If ZIP metadata changed (size or mtime) → remove and re-extract
+        4. If metadata matches → use existing
+
+        Uses marker file (.zip_meta) to track ZIP metadata. More reliable than
+        just mtime comparison, especially in Docker where timestamps can be misleading.
+
+        Args:
+            base_dir: Target directory for extraction
+            zip_path: Path to ZIP archive
+            app_name: Name of the app (for logging)
+
+        Returns:
+            bool: True if extraction succeeded or not needed, False if failed
+        """
+        should_extract = False
+
+        # Check if ZIP exists, try to download if not
+        if not zip_path.exists():
+            logger.info(f"[{app_name}] ZIP not found locally, attempting auto-download...")
+            if not ensure_frontend_asset(app_name):
+                logger.error(f"[{app_name}] ZIP not found and download failed: {zip_path}")
+                return False
+            logger.info(f"[{app_name}] ZIP downloaded successfully")
+
+        # Get ZIP metadata (size + mtime for reliable comparison)
+        zip_stat = zip_path.stat()
+        current_meta = f"{zip_stat.st_size}:{zip_stat.st_mtime}"
+
+        # Marker file stores ZIP metadata
+        marker_file = base_dir / '.zip_meta'
+
+        # Priority 1: If directory doesn't exist at all - always extract
+        if not base_dir.exists():
+            should_extract = True
+            logger.info(f"[{app_name}] Directory doesn't exist, will extract")
+
+        # Priority 2: Marker file doesn't exist - extract (first run or corrupted)
+        elif not marker_file.exists():
+            should_extract = True
+            logger.info(f"[{app_name}] No marker file found, will extract")
+
+        # Priority 3: Compare stored metadata with current ZIP metadata
+        else:
+            try:
+                stored_meta = marker_file.read_text().strip()
+                if stored_meta != current_meta:
+                    logger.info(f"[{app_name}] ZIP metadata changed (stored: {stored_meta}, current: {current_meta}), re-extracting")
+                    try:
+                        shutil.rmtree(base_dir)
+                        should_extract = True
+                    except Exception as e:
+                        logger.error(f"[{app_name}] Failed to remove old directory: {e}")
+                        return False
+                else:
+                    logger.info(f"[{app_name}] ZIP unchanged (meta: {current_meta}), using existing directory")
+            except Exception as e:
+                logger.warning(f"[{app_name}] Failed to read marker file: {e}, will re-extract")
+                should_extract = True
+
+        # Extract ZIP if needed
+        if should_extract:
+            logger.info(f"[{app_name}] Extracting {zip_path.name} to {base_dir}...")
+            try:
+                base_dir.parent.mkdir(parents=True, exist_ok=True)
+                with zipfile.ZipFile(zip_path, 'r') as zip_ref:
+                    zip_ref.extractall(base_dir)
+
+                # Fix HTML links after extraction
+                # fix_html_links_after_extraction(base_dir, app_name)
+
+                # Write marker file with current metadata
+                marker_file.write_text(current_meta)
+                logger.info(f"[{app_name}] Successfully extracted {zip_path.name} and saved marker (meta: {current_meta})")
+                return True
+            except Exception as e:
+                logger.error(f"[{app_name}] Failed to extract: {e}")
+                return False
+
+        # Directory exists and is up-to-date
+        return True
+
+
+@method_decorator(xframe_options_exempt, name='dispatch')
+class NextJSStaticView(ZipExtractionMixin, View):
+    """
+    Serve Next.js static build files with automatic JWT token injection and precompression support.
+
+    Features:
+    - Serves Next.js static export files like a static file server
+    - Smart ZIP extraction: compares ZIP metadata (size + mtime) with marker file
+    - Automatically injects JWT tokens for authenticated users (HTML only)
+    - **Precompression support**: Automatically serves .br or .gz files if available
+    - Handles Next.js client-side routing (.html fallback)
+    - Automatically serves index.html for directory paths
+    - X-Frame-Options exempt to allow embedding in iframes
+
+    Compression Strategy:
+    - Brotli (.br) preferred over Gzip (.gz) - ~5-15% better compression
+    - Automatically detects browser support via Accept-Encoding header
+    - Skips compression for HTML files (JWT injection requires uncompressed content)
+    - Only serves precompressed files, no runtime compression
+
+    ZIP Extraction Logic:
+    - If directory doesn't exist: extract from ZIP
+    - If marker file missing: extract from ZIP
+    - If ZIP metadata changed: remove and re-extract
+    - If metadata matches: use existing files
+    - Marker file (.zip_meta) ensures reliable comparison in Docker
+
+    Path resolution examples:
+    - /cfg/admin/              → /cfg/admin/index.html
+    - /cfg/admin/private/      → /cfg/admin/private/index.html (if exists)
+    - /cfg/admin/private/      → /cfg/admin/private.html (fallback)
+    - /cfg/admin/tasks         → /cfg/admin/tasks.html
+    - /cfg/admin/tasks         → /cfg/admin/tasks/index.html (fallback)
+
+    Compression examples:
+    - _app.js (br supported)   → _app.js.br + Content-Encoding: br
+    - _app.js (gzip supported) → _app.js.gz + Content-Encoding: gzip
+    - _app.js (no support)     → _app.js (uncompressed)
+    - index.html               → index.html (never compressed, needs JWT injection)
+    """
+
+    app_name = 'admin'
+
+    def get(self, request, path=''):
+        """Serve static files from Next.js build with JWT injection and compression support."""
+        import django_cfg
+
+        base_dir = Path(django_cfg.__file__).parent / 'static' / 'frontend' / self.app_name
+        zip_path = Path(django_cfg.__file__).parent / 'static' / 'frontend' / f'{self.app_name}.zip'
+
+        # Extract ZIP if needed using mixin
+        if not self.extract_zip_if_needed(base_dir, zip_path, self.app_name):
+            return render(request, 'frontend/404.html', status=404)
+
+        # Ensure directory exists
+        if not base_dir.exists():
+            logger.error(f"[{self.app_name}] Directory doesn't exist after extraction attempt")
+            return render(request, 'frontend/404.html', status=404)
+
+        original_path = path  # Store for logging
+
+        # Default to index.html for root path
+        if not path or path == '/':
+            path = 'index.html'
+            logger.debug(f"Root path requested, serving: {path}")
+
+        # Resolve file path with SPA routing fallback strategy
+        path = resolve_spa_path(base_dir, path)
+
+        # For HTML files, remove conditional GET headers to force full response
+        # This allows JWT token injection (can't inject into 304 Not Modified responses)
+        is_html_file = path.endswith('.html')
+        if is_html_file and request.user.is_authenticated:
+            request.META.pop('HTTP_IF_MODIFIED_SINCE', None)
+            request.META.pop('HTTP_IF_NONE_MATCH', None)
+
+        # Try to serve precompressed file if browser supports it
+        accept_encoding = request.META.get('HTTP_ACCEPT_ENCODING', '')
+        compressed_path, encoding = find_precompressed_file(base_dir, path, accept_encoding)
+        if compressed_path:
+            logger.debug(f"[Compression] Serving {encoding} for {path}")
+            response = serve(request, compressed_path, document_root=str(base_dir))
+            response['Content-Encoding'] = encoding
+            # Remove Content-Length as it's incorrect for compressed content
+            if 'Content-Length' in response:
+                del response['Content-Length']
+        else:
+            # Serve the static file normally
+            response = serve(request, path, document_root=str(base_dir))
+
+        # Convert FileResponse to HttpResponse for HTML files to enable JWT injection
+        if isinstance(response, FileResponse):
+            converted_response = convert_file_response_to_http_response(response, request)
+            if converted_response:
+                response = converted_response
+
+        # Inject JWT tokens for authenticated users on HTML responses
+        if should_inject_jwt(request, response):
+            inject_jwt_tokens(request, response)
+
+        # Disable caching for HTML files (prevent Cloudflare/browser caching)
+        if is_html_file:
+            response['Cache-Control'] = 'no-store, no-cache, must-revalidate, max-age=0'
+            response['Pragma'] = 'no-cache'
+            response['Expires'] = '0'
+
+        return response
+
+
+class AdminView(UserPassesTestMixin, NextJSStaticView):
+    """Serve Next.js Admin Panel. Only accessible to admin users."""
+    app_name = 'admin'
+
+    def test_func(self):
+        """Check if user is admin (staff or superuser)."""
+        return self.request.user.is_authenticated and (
+            self.request.user.is_staff or self.request.user.is_superuser
+        )
+
+    def handle_no_permission(self):
+        """Redirect to admin login if not authenticated, otherwise 403."""
+        if not self.request.user.is_authenticated:
+            from django.contrib.auth.views import redirect_to_login
+            return redirect_to_login(self.request.get_full_path())
+        # User is authenticated but not admin - show 403
+        return render(self.request, 'frontend/403.html', status=403)

django_cfg/apps/system/totp/README.md

@@ -0,0 +1,292 @@
+# TOTP 2FA App - Quick Start
+
+## ✅ Implementation Complete
+
+The TOTP two-factor authentication app for django-cfg is fully implemented and ready for use!
+
+## 📁 Project Structure
+
+```
+totp/
+├── @docs/                       # Complete documentation
+│   ├── README.md               # This file
+│   ├── ARCHITECTURE.md         # Technical design
+│   ├── API.md                  # API reference
+│   ├── INTEGRATION.md          # Integration guides
+│   ├── TASKS.md                # Implementation tasks
+│   └── IMPLEMENTATION_STATUS.md # Current status
+├── models/                      # Data models
+│   ├── device.py               # TOTPDevice
+│   ├── backup_code.py          # BackupCode
+│   ├── session.py              # TwoFactorSession
+│   └── choices.py              # Enums
+├── services/                    # Business logic
+│   ├── totp_service.py         # TOTP operations
+│   ├── backup_service.py       # Backup codes
+│   └── session_service.py      # 2FA sessions
+├── serializers/                 # DRF serializers
+│   ├── setup.py                # Setup flow
+│   ├── verify.py               # Verification
+│   ├── device.py               # Device management
+│   └── backup.py               # Backup codes
+├── views/                       # API endpoints
+│   ├── setup.py                # Setup views
+│   ├── verify.py               # Verification views
+│   ├── device.py               # Device management
+│   └── backup.py               # Backup codes
+├── middleware/                  # Django middleware
+│   └── __init__.py             # TwoFactorMiddleware
+├── decorators/                  # View decorators
+│   └── __init__.py             # @require_2fa
+├── admin/                       # Django admin
+│   └── __init__.py             # Admin interfaces
+├── migrations/                  # Database migrations
+├── __init__.py
+├── apps.py                      # AppConfig
+├── urls.py                      # URL routing
+└── signals.py                   # Django signals
+```
+
+## 🚀 Quick Setup
+
+### 1. Dependencies Already Added
+
+Dependencies have been added to `pyproject.toml`:
+- `pyotp>=2.9.0,<3.0` - TOTP implementation
+- `qrcode>=8.2,<9.0` - QR code generation
+
+### 2. Run Migrations
+
+```bash
+cd /Users/markinmatrix/Documents/htdocs/@CARAPIS/encar_parser_new/@projects/djangocfg/projects/django-cfg
+python manage.py makemigrations django_cfg_totp
+python manage.py migrate
+```
+
+### 3. Add to Your DjangoConfig
+
+```python
+# In your config.py or settings
+class MyConfig(DjangoConfig):
+    project_apps: List[str] = [
+        "django_cfg.apps.system.totp",
+        # ... other apps
+    ]
+```
+
+### 4. Add URLs
+
+```python
+# In your main urls.py
+urlpatterns = [
+    # ... other URLs
+    path("api/2fa/", include("django_cfg.apps.system.totp.urls")),
+]
+```
+
+## 📖 Usage Examples
+
+### Independent Service Usage
+
+```python
+from django_cfg.apps.system.totp.services import TOTPService, BackupCodeService
+
+# Setup 2FA for user
+device = TOTPService.create_device(user, name="My Phone")
+provisioning_uri = TOTPService.get_provisioning_uri(device, issuer="My App")
+qr_code = TOTPService.generate_qr_code(provisioning_uri)
+
+# Show QR code to user, then confirm with first code
+if TOTPService.confirm_device(device, user_entered_code):
+    # Generate backup codes
+    backup_codes = BackupCodeService.generate_codes(user)
+    # Show backup codes to user (only shown once!)
+```
+
+### API Integration
+
+```bash
+# 1. Start 2FA setup
+curl -X POST /api/2fa/setup/ \
+  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
+  -d '{"device_name": "My iPhone"}'
+
+# Response includes QR code and secret
+
+# 2. Confirm setup
+curl -X POST /api/2fa/setup/confirm/ \
+  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
+  -d '{"device_id": "...", "code": "123456"}'
+
+# Response includes backup codes
+
+# 3. During login (after OTP verification)
+# If user has 2FA enabled, create session
+session = TwoFactorSession.create_for_user(user, request)
+return {"requires_2fa": True, "session_id": session.id}
+
+# 4. Verify 2FA
+curl -X POST /api/2fa/verify/ \
+  -d '{"session_id": "...", "code": "123456"}'
+
+# Response includes JWT tokens
+```
+
+### Protect Views with Decorator
+
+```python
+from django_cfg.apps.system.totp.decorators import require_2fa
+
+@require_2fa
+def my_protected_view(request):
+    # Only accessible if user has verified 2FA
+    pass
+
+@require_2fa(max_age_hours=1)
+def very_sensitive_view(request):
+    # Requires fresh verification within last hour
+    pass
+```
+
+### Protect Paths with Middleware
+
+```python
+# In settings or DjangoConfig
+MIDDLEWARE = [
+    # ... other middleware
+    "django_cfg.apps.system.totp.middleware.TwoFactorMiddleware",
+]
+
+TOTP_PROTECTED_PATHS = [
+    "/api/terminal/",
+    "/api/agents/",
+    "/api/machines/",
+]
+```
+
+## 🔗 Integration with Accounts App
+
+See detailed guide in `@docs/INTEGRATION.md`. Key steps:
+
+1. **Modify OTP verification** to check for 2FA:
+
+```python
+# In accounts/views/otp.py
+def verify_otp(self, request):
+    user = OTPService.verify_otp(email, otp_code)
+    
+    if user and TOTPService.has_active_device(user):
+        # Require 2FA
+        session = TwoFactorSessionService.create_session(user, request)
+        return Response({
+            "requires_2fa": True,
+            "session_id": str(session.id),
+        })
+    
+    # No 2FA, return tokens directly
+    return Response({"access_token": ..., "refresh_token": ...})
+```
+
+2. **Add user model properties**:
+
+```python
+# In accounts/models/user.py
+@property
+def has_2fa_enabled(self) -> bool:
+    from django_cfg.apps.system.totp.models import TOTPDevice, DeviceStatus
+    return TOTPDevice.objects.filter(
+        user=self,
+        status=DeviceStatus.ACTIVE
+    ).exists()
+```
+
+## 📊 API Endpoints
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/2fa/setup/` | POST | Start 2FA setup, get QR code |
+| `/2fa/setup/confirm/` | POST | Confirm setup with first code |
+| `/2fa/verify/` | POST | Verify 2FA code during login |
+| `/2fa/verify/backup/` | POST | Verify backup code |
+| `/2fa/devices/` | GET | List user's TOTP devices |
+| `/2fa/devices/{id}/` | DELETE | Remove device |
+| `/2fa/disable/` | POST | Disable 2FA completely |
+| `/2fa/backup-codes/` | GET | Get backup codes status |
+| `/2fa/backup-codes/regenerate/` | POST | Regenerate backup codes |
+
+Full API documentation in `@docs/API.md`.
+
+## 🎯 Use Case: cmdop Terminal Security
+
+Protect terminal and agent access with 2FA:
+
+```python
+# In cmdop/apps/terminal/views.py
+from django_cfg.apps.system.totp.decorators import require_2fa
+
+class TerminalViewSet(ViewSet):
+    @require_2fa(max_age_hours=1)
+    def connect(self, request, terminal_id):
+        """Connect to terminal - requires fresh 2FA"""
+        # User must have verified 2FA within last hour
+        pass
+```
+
+## 🔐 Security Features
+
+- ✅ RFC 6238 compliant TOTP
+- ✅ Google Authenticator compatible
+- ✅ Code reuse prevention (replay attack)
+- ✅ Rate limiting (failed attempts)
+- ✅ Session expiration (5 minutes)
+- ✅ Backup codes with SHA256 hashing
+- ✅ IP and user agent tracking
+- ✅ Audit logging via signals
+- ✅ Telegram notifications
+
+## 📚 Documentation
+
+- **README.md** (this file) - Quick start
+- **ARCHITECTURE.md** - Technical design and patterns
+- **API.md** - Complete API reference
+- **INTEGRATION.md** - Integration guides for various use cases
+- **TASKS.md** - Implementation checklist
+- **IMPLEMENTATION_STATUS.md** - Current completion status
+
+## 🧪 Testing
+
+After setup, test the flow:
+
+1. Create a superuser: `python manage.py createsuperuser`
+2. Run the server: `python manage.py runserver`
+3. Access admin: `http://localhost:8000/admin/`
+4. Test API endpoints with curl or Postman
+5. Scan QR code with Google Authenticator
+
+## 🎉 Status
+
+**✅ FULLY IMPLEMENTED AND READY FOR USE**
+
+All components completed:
+- ✅ Models
+- ✅ Services
+- ✅ Serializers
+- ✅ Views/API
+- ✅ URLs
+- ✅ Middleware
+- ✅ Decorators
+- ✅ Admin
+- ✅ Signals
+- ✅ Documentation
+
+## 📞 Next Steps
+
+1. Run migrations
+2. Test the setup flow
+3. Integrate with accounts app (see INTEGRATION.md)
+4. Configure protected paths if using middleware
+5. Optional: Create TwoFactorConfig for DjangoConfig integration
+
+---
+
+**Questions or issues?** Check the documentation in `@docs/` or review the implementation in the app code.

django_cfg/apps/system/totp/__init__.py

@@ -0,0 +1,38 @@
+"""
+Django CFG Two-Factor Authentication (2FA/TOTP) App.
+
+Provides TOTP-based two-factor authentication for Django applications.
+Can be used independently or integrated with django-cfg accounts flow.
+
+Features:
+- TOTP device management (setup, verify, disable)
+- Backup recovery codes
+- Session-based 2FA verification
+- QR code generation for authenticator apps
+- Configurable enforcement policies
+
+Usage:
+    # Independent usage
+    from django_cfg.apps.system.totp.services import TOTPService
+
+    # Setup 2FA for user
+    device = TOTPService.create_device(user)
+    qr_uri = TOTPService.get_provisioning_uri(device)
+
+    # Verify code
+    is_valid = TOTPService.verify_code(device, "123456")
+
+    # Integration with DjangoConfig
+    class MyConfig(DjangoConfig):
+        two_factor: TwoFactorConfig = TwoFactorConfig(
+            enabled=True,
+            issuer_name="My App",
+            enforce_for_staff=True,
+        )
+"""
+
+default_app_config = "django_cfg.apps.system.totp.apps.TOTPConfig"
+
+__all__ = [
+    "default_app_config",
+]