django-cfg 1.4.46__py3-none-any.whl → 1.5.181__py3-none-any.whl

django_cfg/core/integration/url_integration.py

@@ -4,7 +4,9 @@ Django CFG URL integration utilities.
 Provides automatic URL registration for django_cfg endpoints and integrations.
 """
 
-from typing import List
+import importlib
+import sys
+from typing import List, Set
 
 from django.conf import settings
 from django.conf.urls.static import static
@@ -12,6 +14,86 @@ from django.urls import URLPattern, include, path
 from django.views.static import serve
 
 
+def _get_openapi_group_urls() -> List[URLPattern]:
+    """
+    Automatically generate URL patterns from OpenAPI groups.
+
+    For each OpenAPI group defined in config:
+    1. Get the group from OpenAPI service
+    2. Get the apps for that group
+    3. For each app with urls.py, include it
+    4. Add path("{api_prefix}/{app_basename}/", include("{app}.urls"))
+
+    Returns:
+        List of URL patterns for OpenAPI groups
+    """
+    patterns = []
+
+    try:
+        from django_cfg.modules.django_client.core import get_openapi_service
+
+        service = get_openapi_service()
+
+        # Check if OpenAPI client is configured and enabled
+        if not service.config or not service.is_enabled():
+            return patterns
+
+        # Get API prefix from config (default: "api")
+        api_prefix = getattr(service.config, 'api_prefix', 'api') or 'api'
+        api_prefix = api_prefix.rstrip('/')  # Remove trailing slash
+
+        # Track already added apps to avoid duplicates
+        added_apps: Set[str] = set()
+
+        # Get all groups from config
+        for group_config in service.config.groups:
+            group_name = group_config.name
+
+            # Skip the internal "cfg" group - it's handled separately
+            if group_name == "cfg":
+                continue
+
+            # Get apps for this group
+            apps = group_config.apps
+
+            # Process each app in the group
+            for app_name in apps:
+                # Skip if already added
+                if app_name in added_apps:
+                    continue
+
+                # Check if the app has a urls.py module
+                try:
+                    urls_module = f"{app_name}.urls"
+                    importlib.import_module(urls_module)
+
+                    # Get the app basename (last part of the app path)
+                    # e.g., "apps.workspaces" -> "workspaces"
+                    app_basename = app_name.split('.')[-1]
+
+                    # Add URL pattern for this app
+                    url_pattern = f"{api_prefix}/{app_basename}/"
+                    patterns.append(path(url_pattern, include(urls_module)))
+                    added_apps.add(app_name)
+
+                    # Log successful auto-registration
+                    sys.stderr.write(f"✅ Auto-registered URL: /{url_pattern} -> {urls_module}\n")
+                    sys.stderr.flush()
+
+                except ImportError as e:
+                    # App doesn't have urls.py - skip it
+                    sys.stderr.write(f"⚠️  Skipping {app_name}: {e}\n")
+                    sys.stderr.flush()
+                    continue
+
+    except Exception as e:
+        # Don't break if OpenAPI config is not available
+        sys.stderr.write(f"❌ ERROR: Could not auto-add OpenAPI group URLs: {e}\n")
+        sys.stderr.flush()
+
+    return patterns
+
+
 def add_django_cfg_urls(urlpatterns: List[URLPattern]) -> List[URLPattern]:
     """
     Automatically add django_cfg URLs and all integrations to the main URL configuration.
@@ -49,6 +131,21 @@ def add_django_cfg_urls(urlpatterns: List[URLPattern]) -> List[URLPattern]:
         path("", include("django_cfg.apps.urls")),
     ]
 
+    # Automatically add OpenAPI group URLs from config
+    openapi_urls = _get_openapi_group_urls()
+    if openapi_urls:
+        new_patterns += openapi_urls
+
+    # Automatically add extension URLs (from extensions/ folder)
+    try:
+        from django_cfg.extensions.urls import get_extension_url_patterns
+        extension_urls = get_extension_url_patterns(url_prefix="cfg")
+        if extension_urls:
+            new_patterns += extension_urls
+    except Exception as e:
+        sys.stderr.write(f"❌ ERROR: Could not auto-add extension URLs: {e}\n")
+        sys.stderr.flush()
+
     # Add django-browser-reload URLs in development (if installed)
     if settings.DEBUG:
         try:
@@ -66,12 +163,29 @@ def add_django_cfg_urls(urlpatterns: List[URLPattern]) -> List[URLPattern]:
 
     # Add media files serving (both dev and prod)
     # Using serve view for consistent behavior across environments
-    if hasattr(settings, 'MEDIA_URL') and hasattr(settings, 'MEDIA_ROOT'):
-        # Remove leading slash from MEDIA_URL for path()
-        media_prefix = settings.MEDIA_URL.lstrip('/')
-        new_patterns += [
-            path(f"{media_prefix}<path:path>", serve, {"document_root": settings.MEDIA_ROOT}),
-        ]
+    # Django will serve media files when MEDIA_ROOT is set
+    # If using external CDN, requests won't reach Django anyway
+    media_root = getattr(settings, 'MEDIA_ROOT', None)
+    media_url = getattr(settings, 'MEDIA_URL', None)
+
+    if media_root and media_url:
+        from django.urls import re_path
+        from urllib.parse import urlparse
+
+        # Extract path prefix from media_url
+        if media_url.startswith(('http://', 'https://', '//')):
+            # Absolute URL - extract path part
+            # e.g., "https://api.example.com/media/" -> "media/"
+            parsed = urlparse(media_url)
+            media_prefix = parsed.path.strip('/')
+        else:
+            # Relative URL - use directly
+            media_prefix = media_url.strip('/')
+
+        if media_prefix:
+            new_patterns += [
+                re_path(rf'^{media_prefix}/(?P<path>.*)$', serve, {'document_root': media_root}),
+            ]
 
     # Show startup info based on config
     try:
@@ -91,7 +205,7 @@ def get_django_cfg_urls_info() -> dict:
         Dictionary with complete URL integration info
     """
     from django_cfg.config import (
-        LIB_DOCS_URL,
+        LIB_SITE_URL,
         LIB_GITHUB_URL,
         LIB_HEALTH_URL,
         LIB_NAME,
@@ -120,7 +234,7 @@ def get_django_cfg_urls_info() -> dict:
             "prefix": "cfg/",
             "description": LIB_NAME,
             "site_url": LIB_SITE_URL,
-            "docs_url": LIB_DOCS_URL,
+            "docs_url": LIB_SITE_URL,
             "github_url": LIB_GITHUB_URL,
             "support_url": LIB_SUPPORT_URL,
             "health_url": LIB_HEALTH_URL,

django_cfg/core/integration/version_checker.py

@@ -13,11 +13,11 @@ from cachetools import TTLCache
 
 class VersionChecker:
     """
-    Checks for library updates on PyPI with 24-hour caching using cachetools.
+    Checks for library updates on PyPI with 1-hour caching using cachetools.
     """
 
-    # Cache for 24 hours (86400 seconds)
-    CACHE_TTL = 86400
+    # Cache for 1 hour (3600 seconds)
+    CACHE_TTL = 3600
 
     def __init__(self):
         """Initialize version checker with TTL cache."""

django_cfg/core/middleware/__init__.py

@@ -0,0 +1,9 @@
+"""
+Django-CFG Middleware.
+
+Custom middleware for Django-CFG applications.
+"""
+
+from .public_api_cors import PublicAPICORSMiddleware
+
+__all__ = ["PublicAPICORSMiddleware"]

django_cfg/core/middleware/noindex.py

@@ -0,0 +1,71 @@
+"""
+Django-CFG Middleware: Prevent Search Engine Indexing
+
+Universal middleware that adds X-Robots-Tag header to prevent search engines
+from indexing the entire Django project.
+
+This ensures that your Django application (admin panels, APIs, internal tools, etc.)
+is not exposed in search engine results.
+"""
+
+from django.http import HttpRequest, HttpResponse
+from typing import Callable
+
+
+class NoIndexMiddleware:
+    """
+    Universal middleware to prevent search engine indexing of entire Django project.
+
+    Adds X-Robots-Tag: noindex, nofollow header to ALL responses.
+    Adds Cache-Control headers to sensitive paths (/cfg/, /admin/).
+
+    Usage:
+        Add to MIDDLEWARE in settings.py:
+        ```python
+        MIDDLEWARE = [
+            ...
+            'django_cfg.core.middleware.noindex.NoIndexMiddleware',
+            ...
+        ]
+        ```
+
+    Headers Added:
+        - X-Robots-Tag: noindex, nofollow (ALL responses)
+        - Cache-Control: no-cache, no-store, must-revalidate (for /cfg/* and /admin/* paths)
+
+    Example Response:
+        HTTP/1.1 200 OK
+        X-Robots-Tag: noindex, nofollow
+        Cache-Control: no-cache, no-store, must-revalidate
+    """
+
+    def __init__(self, get_response: Callable[[HttpRequest], HttpResponse]):
+        """
+        Initialize middleware.
+
+        Args:
+            get_response: Next middleware or view in chain
+        """
+        self.get_response = get_response
+
+    def __call__(self, request: HttpRequest) -> HttpResponse:
+        """
+        Process request and add noindex header to ALL responses.
+
+        Args:
+            request: HTTP request
+
+        Returns:
+            HTTP response with X-Robots-Tag header on all responses
+        """
+        # Get response from next middleware/view
+        response = self.get_response(request)
+
+        # Add X-Robots-Tag header to ALL responses to prevent indexing
+        response['X-Robots-Tag'] = 'noindex, nofollow'
+
+        # Add Cache-Control to prevent caching for sensitive paths (security best practice)
+        if request.path.startswith('/cfg/') or request.path.startswith('/admin/'):
+            response['Cache-Control'] = 'no-cache, no-store, must-revalidate'
+
+        return response

django_cfg/core/middleware/public_api_cors.py

@@ -0,0 +1,132 @@
+"""
+Public API CORS Middleware.
+
+Handles CORS for public API endpoints BEFORE django-cors-headers middleware.
+This allows truly public endpoints (like lead submission) to accept requests
+from any origin while keeping the rest of the app secured.
+
+IMPORTANT: This middleware MUST be placed BEFORE 'corsheaders.middleware.CorsMiddleware'
+in MIDDLEWARE settings for it to work correctly.
+"""
+
+import re
+from typing import Callable, List, Optional
+
+from django.conf import settings
+from django.http import HttpRequest, HttpResponse
+
+
+class PublicAPICORSMiddleware:
+    """
+    Middleware that handles CORS for public API endpoints.
+
+    Public API endpoints can be configured via:
+    - PUBLIC_API_CORS_PATHS: List of path prefixes (e.g., ['/cfg/leads/', '/api/public/'])
+    - PUBLIC_API_CORS_REGEX: Regex pattern for matching paths
+
+    All matching paths will have open CORS (Access-Control-Allow-Origin: *).
+
+    Example settings.py:
+        PUBLIC_API_CORS_PATHS = [
+            '/cfg/leads/',
+            '/api/webhooks/',
+        ]
+
+    Or using regex:
+        PUBLIC_API_CORS_REGEX = r'^/(cfg/leads|api/webhooks)/'
+
+    Usage in MIDDLEWARE (must be BEFORE corsheaders):
+        MIDDLEWARE = [
+            'django_cfg.core.middleware.PublicAPICORSMiddleware',  # FIRST!
+            'corsheaders.middleware.CorsMiddleware',
+            ...
+        ]
+    """
+
+    # Default CORS headers for public APIs
+    CORS_HEADERS = {
+        "Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS",
+        "Access-Control-Allow-Headers": (
+            "Content-Type, Authorization, X-Requested-With, Accept, Origin, "
+            "X-CSRFToken, X-Forwarded-For, User-Agent, Referer, "
+            "sec-ch-ua, sec-ch-ua-mobile, sec-ch-ua-platform"
+        ),
+        "Access-Control-Max-Age": "86400",
+    }
+
+    def __init__(self, get_response: Callable[[HttpRequest], HttpResponse]):
+        self.get_response = get_response
+
+        # Get configuration from settings
+        self.public_paths: List[str] = getattr(
+            settings, "PUBLIC_API_CORS_PATHS", ["/cfg/leads/"]
+        )
+        self.public_regex: Optional[str] = getattr(
+            settings, "PUBLIC_API_CORS_REGEX", None
+        )
+
+        # Compile regex if provided
+        self._compiled_regex = None
+        if self.public_regex:
+            self._compiled_regex = re.compile(self.public_regex)
+
+    def __call__(self, request: HttpRequest) -> HttpResponse:
+        """Process request and add CORS headers for public API paths."""
+
+        # Check if this is a public API path
+        if not self._is_public_api_path(request.path):
+            return self.get_response(request)
+
+        # Handle OPTIONS preflight request
+        if request.method == "OPTIONS":
+            response = HttpResponse(status=200)
+            self._add_cors_headers(response, request)
+            return response
+
+        # Process request and add CORS headers to response
+        response = self.get_response(request)
+        self._add_cors_headers(response, request)
+
+        return response
+
+    def _is_public_api_path(self, path: str) -> bool:
+        """
+        Check if the request path is a public API endpoint.
+
+        Args:
+            path: Request path (e.g., '/cfg/leads/submit/')
+
+        Returns:
+            True if path matches public API configuration
+        """
+        # Check path prefixes
+        for public_path in self.public_paths:
+            if path.startswith(public_path):
+                return True
+
+        # Check regex pattern
+        if self._compiled_regex and self._compiled_regex.match(path):
+            return True
+
+        return False
+
+    def _add_cors_headers(self, response: HttpResponse, request: HttpRequest) -> None:
+        """
+        Add CORS headers to response.
+        
+        For public APIs we allow ANY origin without restrictions.
+        Always echo back the Origin header if present, or use * as fallback.
+        """
+        # Get origin from request, default to * for universal access
+        origin = request.META.get("HTTP_ORIGIN", "*")
+
+        # Always allow the requesting origin
+        response["Access-Control-Allow-Origin"] = origin
+        response["Access-Control-Allow-Methods"] = self.CORS_HEADERS["Access-Control-Allow-Methods"]
+        response["Access-Control-Allow-Headers"] = self.CORS_HEADERS["Access-Control-Allow-Headers"]
+        response["Access-Control-Max-Age"] = self.CORS_HEADERS["Access-Control-Max-Age"]
+        
+        # Only set credentials when we have specific origin (not wildcard)
+        # This is required by CORS spec: can't use credentials with '*'
+        if origin != "*":
+            response["Access-Control-Allow-Credentials"] = "true"

django_cfg/core/utils/__init__.py

@@ -0,0 +1,5 @@
+"""Core utilities for django-cfg."""
+
+from .url_helpers import get_otp_url, get_ticket_url
+
+__all__ = ["get_ticket_url", "get_otp_url"]

django_cfg/core/utils/url_helpers.py

@@ -0,0 +1,73 @@
+"""
+URL generation utilities for django-cfg.
+
+Provides helper functions to generate URLs dynamically from site_url configuration.
+"""
+
+import logging
+from typing import Optional
+
+logger = logging.getLogger(__name__)
+
+
+def get_ticket_url(ticket_uuid: str, fallback: str = "#ticket") -> str:
+    """
+    Generate support ticket URL on the fly from site_url.
+
+    Args:
+        ticket_uuid: UUID of the support ticket
+        fallback: Fallback URL if config is not available (default: "#ticket")
+
+    Returns:
+        Complete URL to the ticket
+
+    Example:
+        >>> get_ticket_url("abc-123-def")
+        "https://yoursite.com/support/ticket/abc-123-def"
+    """
+    try:
+        from django_cfg.core.state import get_current_config
+        config = get_current_config()
+
+        if config and hasattr(config, 'site_url'):
+            return f"{config.site_url}/support/ticket/{ticket_uuid}"
+        else:
+            logger.warning("Config or site_url not available for ticket URL generation")
+            return f"{fallback}-{ticket_uuid}"
+
+    except Exception as e:
+        logger.warning(f"Could not generate ticket URL: {e}")
+        return f"{fallback}-{ticket_uuid}"
+
+
+def get_otp_url(otp_code: str, fallback: str = "#otp") -> str:
+    """
+    Generate OTP verification URL on the fly from site_url.
+
+    Args:
+        otp_code: OTP verification code
+        fallback: Fallback URL if config is not available (default: "#otp")
+
+    Returns:
+        Complete URL to the OTP verification page
+
+    Example:
+        >>> get_otp_url("123456")
+        "https://yoursite.com/auth/?otp=123456"
+    """
+    try:
+        from django_cfg.core.state import get_current_config
+        config = get_current_config()
+
+        if config and hasattr(config, 'site_url'):
+            return f"{config.site_url}/auth/?otp={otp_code}"
+        else:
+            logger.warning("Config or site_url not available for OTP URL generation")
+            return f"{fallback}-{otp_code}"
+
+    except Exception as e:
+        logger.warning(f"Could not generate OTP URL: {e}")
+        return f"{fallback}-{otp_code}"
+
+
+__all__ = ["get_ticket_url", "get_otp_url"]

django_cfg/core/validation.py

@@ -78,7 +78,7 @@ class ConfigurationValidator:
             errors.append("SECRET_KEY must be at least 50 characters long")
         else:
             # Check for insecure patterns in production
-            if config.env_mode == 'production':
+            if config.is_production:
                 insecure_patterns = [
                     'django-insecure',
                     'change-me',
@@ -107,7 +107,7 @@ class ConfigurationValidator:
                     errors.append(f"Invalid hostname in ALLOWED_HOSTS[{i}]: '{host}'")
 
             # Production-specific validation
-            if config.env_mode == 'production' and '*' in allowed_hosts:
+            if config.is_production and '*' in allowed_hosts:
                 errors.append("Wildcard '*' in ALLOWED_HOSTS is not recommended for production")
 
         return errors
@@ -140,7 +140,7 @@ class ConfigurationValidator:
         errors = []
 
         # Environment-specific security validation
-        if config.env_mode == 'production':
+        if config.is_production:
             # Allow DEBUG=True in production for development purposes
             pass
 
@@ -158,9 +158,7 @@ class ConfigurationValidator:
         """Validate environment-specific consistency."""
         errors = []
 
-        environment = config.env_mode
-
-        if environment == 'production':
+        if config.is_production:
             # Production requirements - allow DEBUG=True for development
             pass
 

django_cfg/extensions/__init__.py

@@ -0,0 +1,80 @@
+"""
+Django-CFG Extensions System
+
+Auto-discovers and loads extensions from the user's project.
+Extensions are placed in extensions/ folder and work as-is.
+
+Usage:
+    # In your extension's __cfg__.py:
+    from django_cfg.extensions.configs.apps.leads import BaseLeadsSettings
+
+    class LeadsSettings(BaseLeadsSettings):
+        telegram_enabled: bool = False  # override defaults
+
+    settings = LeadsSettings()
+
+Project Structure:
+    your_project/
+    └── extensions/
+        ├── apps/           # Django apps with models
+        │   └── leads/
+        │       ├── __cfg__.py   # Required: settings = LeadsSettings()
+        │       ├── apps.py
+        │       ├── models.py
+        │       ├── admin.py
+        │       ├── urls.py      # Main API: /cfg/leads/
+        │       ├── urls_admin.py # Admin API: /cfg/leads/admin/
+        │       └── ...
+        └── modules/        # Utility modules (no models)
+            └── analytics/
+
+URL Convention:
+    - urls.py -> /cfg/{prefix}/ (main API)
+    - urls_admin.py -> /cfg/{prefix}/admin/ (admin API)
+    - urls_system.py -> /cfg/{prefix}/system/ (system API)
+    - urls_<name>.py -> /cfg/{prefix}/<name>/ (custom suffix)
+"""
+
+from .configs.apps.base import (
+    BaseExtensionSettings,
+    NavigationItem,
+    NavigationSection,
+)
+from .configs.apps import BaseCurrencySettings
+from .configs.modules import BaseModuleSettings
+from .scanner import DiscoveredExtension, ExtensionScanner
+from .loader import ExtensionLoader, get_extension_loader
+from .module_loader import ModuleLoader, get_module_loader, requires_module
+from .mixin import ExtensionMixin, get_extension_helper
+from .urls import discover_url_modules, get_extension_url_patterns
+from .constance import get_extension_constance_fields
+from .schedules import get_extension_schedules
+
+__all__ = [
+    # Base settings for apps
+    "BaseExtensionSettings",
+    "NavigationItem",
+    "NavigationSection",
+    # Base settings for modules
+    "BaseModuleSettings",
+    "BaseCurrencySettings",
+    # App Discovery
+    "ExtensionScanner",
+    "DiscoveredExtension",
+    "ExtensionLoader",
+    "get_extension_loader",
+    # Module Discovery
+    "ModuleLoader",
+    "get_module_loader",
+    "requires_module",
+    # URL discovery
+    "discover_url_modules",
+    "get_extension_url_patterns",
+    # Constance fields discovery
+    "get_extension_constance_fields",
+    # RQ schedules discovery
+    "get_extension_schedules",
+    # Mixin for BaseCfgModule
+    "ExtensionMixin",
+    "get_extension_helper",
+]

django_cfg/extensions/configs/__init__.py

@@ -0,0 +1,9 @@
+"""
+Extension configuration base classes.
+
+Provides typed Pydantic configuration classes for extensions.
+Users extend these base classes in their extension's config.py.
+"""
+
+from .apps import *  # noqa: F401, F403
+from .modules import *  # noqa: F401, F403

django_cfg/extensions/configs/apps/__init__.py

@@ -0,0 +1,39 @@
+"""
+Base configuration classes for extension apps.
+
+Each app extension has a corresponding base settings class here.
+"""
+
+from .base import (
+    APP_LABEL_PREFIX,
+    BaseExtensionSettings,
+    ExtensionScheduleConfig,
+    NavigationItem,
+    NavigationSection,
+)
+from .agents import BaseAgentsSettings
+from .backup import BaseBackupSettings
+from .currency import BaseCurrencySettings
+from .knowbase import BaseKnowbaseSettings
+from .leads import BaseLeadsSettings
+from .maintenance import BaseMaintenanceSettings
+from .newsletter import BaseNewsletterSettings
+from .payments import BasePaymentsSettings
+from .support import BaseSupportSettings
+
+__all__ = [
+    "APP_LABEL_PREFIX",
+    "BaseExtensionSettings",
+    "ExtensionScheduleConfig",
+    "NavigationItem",
+    "NavigationSection",
+    "BaseAgentsSettings",
+    "BaseBackupSettings",
+    "BaseCurrencySettings",
+    "BaseKnowbaseSettings",
+    "BaseLeadsSettings",
+    "BaseMaintenanceSettings",
+    "BaseNewsletterSettings",
+    "BasePaymentsSettings",
+    "BaseSupportSettings",
+]