django-cfg 1.4.48__py3-none-any.whl → 1.5.7__py3-none-any.whl

django_cfg/core/builders/apps_builder.py

@@ -23,7 +23,6 @@ class InstalledAppsBuilder:
     - Combine default Django/third-party apps
     - Add django-cfg apps based on enabled features
     - Handle special ordering (accounts before admin)
-    - Auto-enable tasks if needed
     - Auto-detect dashboard apps from Unfold
     - Add project-specific apps
     - Remove duplicates while preserving order
@@ -55,7 +54,7 @@ class InstalledAppsBuilder:
             >>> config = DjangoConfig(enable_support=True)
             >>> builder = InstalledAppsBuilder(config)
             >>> apps = builder.build()
-            >>> "django_cfg.apps.support" in apps
+            >>> "django_cfg.apps.business.support" in apps
             True
         """
         apps = []
@@ -92,7 +91,7 @@ class InstalledAppsBuilder:
             if app == "django.contrib.admin":
                 # Insert accounts before admin if enabled (for proper migration order)
                 if self.config.enable_accounts:
-                    apps.append("django_cfg.apps.accounts")
+                    apps.append("django_cfg.apps.business.accounts")
             apps.append(app)
 
         return apps
@@ -109,32 +108,46 @@ class InstalledAppsBuilder:
             "django_cfg.modules.django_tailwind",  # Universal Tailwind layouts
             "django_cfg.apps.api.health",
             "django_cfg.apps.api.commands",
+            "django_cfg.apps.system.dashboard",  # Dashboard API
         ]
 
+        if self.config.enable_frontend:
+            apps.append("django_cfg.apps.system.frontend")
+
         # Add optional apps based on configuration
         if self.config.enable_support:
-            apps.append("django_cfg.apps.support")
+            apps.append("django_cfg.apps.business.support")
 
         if self.config.enable_newsletter:
-            apps.append("django_cfg.apps.newsletter")
+            apps.append("django_cfg.apps.business.newsletter")
 
         if self.config.enable_leads:
-            apps.append("django_cfg.apps.leads")
+            apps.append("django_cfg.apps.business.leads")
 
         if self.config.enable_knowbase:
-            apps.append("django_cfg.apps.knowbase")
+            apps.append("django_cfg.apps.business.knowbase")
 
         if self.config.enable_agents:
-            apps.append("django_cfg.apps.agents")
+            apps.append("django_cfg.apps.business.agents")
 
         if self.config.enable_maintenance:
-            apps.append("django_cfg.apps.maintenance")
+            apps.append("django_cfg.apps.system.maintenance")
 
         if self.config.payments and self.config.payments.enabled:
-            apps.append("django_cfg.apps.payments")
+            apps.append("django_cfg.apps.business.payments")
+
+        if self.config.centrifugo and self.config.centrifugo.enabled:
+            apps.append("django_cfg.apps.integrations.centrifugo")
+
+        if self.config.grpc and self.config.grpc.enabled:
+            apps.append("django_cfg.apps.integrations.grpc")
 
-        if self.config.django_ipc and self.config.django_ipc.enabled:
-            apps.append("django_cfg.apps.ipc")
+        if self.config.crypto_fields and self.config.crypto_fields.enabled:
+            apps.append("django_crypto_fields.apps.AppConfig")
+
+        # Next.js Admin Integration
+        if self.config.nextjs_admin:
+            apps.append("django_cfg.modules.nextjs_admin")
 
         return apps
 
@@ -147,10 +160,10 @@ class InstalledAppsBuilder:
         """
         apps = []
 
-        # Auto-enable tasks if needed by other features
-        if self.config.should_enable_tasks():
-            apps.append("django_dramatiq")  # Add django_dramatiq first
-            apps.append("django_cfg.apps.tasks")
+        # Add Django-RQ if enabled
+        if hasattr(self.config, "django_rq") and self.config.django_rq and self.config.django_rq.enabled:
+            apps.append("django_rq")  # Core django-rq package
+            apps.append("django_cfg.apps.integrations.rq")  # Django-CFG monitoring & API
 
         # Add DRF Tailwind theme module (uses Tailwind via CDN)
         if self.config.enable_drf_tailwind:
@@ -176,66 +189,8 @@ class InstalledAppsBuilder:
                 # django-browser-reload not installed, skip it
                 pass
 
-        # Auto-detect dashboard apps from Unfold callback
-        dashboard_apps = self._get_dashboard_apps_from_callback()
-        apps.extend(dashboard_apps)
-
         return apps
 
-    def _get_dashboard_apps_from_callback(self) -> List[str]:
-        """
-        Auto-detect dashboard apps from Unfold dashboard_callback setting.
-
-        Extracts app names from callback paths like:
-        - "api.dashboard.callbacks.main_dashboard_callback" → ["api.dashboard"]
-        - "myproject.admin.callbacks.dashboard" → ["myproject.admin"]
-
-        This allows django-cfg to automatically add dashboard apps to INSTALLED_APPS
-        without requiring manual configuration.
-
-        Returns:
-            List of dashboard app names to add to INSTALLED_APPS
-        """
-        dashboard_apps = []
-
-        # Check if Unfold is configured with a theme
-        if not self.config.unfold or not self.config.unfold.theme:
-            return dashboard_apps
-
-        # Get dashboard callback path from theme
-        callback_path = getattr(self.config.unfold.theme, "dashboard_callback", None)
-        if not callback_path:
-            return dashboard_apps
-
-        try:
-            # Parse callback path: "api.dashboard.callbacks.main_dashboard_callback"
-            # Extract app part: "api.dashboard"
-            parts = callback_path.split(".")
-
-            # Look for common callback patterns
-            callback_indicators = ["callbacks", "views", "handlers"]
-
-            # Find the callback indicator and extract app path before it
-            app_parts = []
-            for i, part in enumerate(parts):
-                if part in callback_indicators:
-                    app_parts = parts[:i]  # Everything before the callback indicator
-                    break
-
-            # If no callback indicator found, assume last part is function name
-            if not app_parts and len(parts) > 1:
-                app_parts = parts[:-1]  # Everything except the last part
-
-            if app_parts:
-                app_name = ".".join(app_parts)
-                dashboard_apps.append(app_name)
-
-        except Exception:
-            # If parsing fails, silently continue - dashboard callback is optional
-            pass
-
-        return dashboard_apps
-
     def _deduplicate(self, apps: List[str]) -> List[str]:
         """
         Remove duplicate apps while preserving order.

django_cfg/core/builders/security_builder.py

@@ -59,10 +59,13 @@ class SecurityBuilder:
             >>> 'ALLOWED_HOSTS' in settings
             True
         """
+        # Get all security domains including auto-extracted from api_url and site_url
+        all_domains = self._get_all_security_domains()
+
         if self.config.is_development or self.config.debug:
             return self._dev_mode_universal()
         else:
-            return self._prod_mode_universal(self.config.security_domains)
+            return self._prod_mode_universal(all_domains)
 
     def build_allowed_hosts(self) -> List[str]:
         """
@@ -91,7 +94,9 @@ class SecurityBuilder:
         Returns:
             Dictionary with dev security settings
         """
-        normalized = self._normalize_domains(self.config.security_domains)
+        # Get all security domains including auto-extracted from api_url and site_url
+        all_domains = self._get_all_security_domains()
+        normalized = self._normalize_domains(all_domains)
 
         # Get all dev CORS origins (popular ports + security_domains)
         dev_cors_origins = self._get_dev_csrf_origins() + normalized['cors_origins']
@@ -123,6 +128,15 @@ class SecurityBuilder:
             'SECURE_CONTENT_TYPE_NOSNIFF': False,
             'SECURE_BROWSER_XSS_FILTER': False,
             'X_FRAME_OPTIONS': 'SAMEORIGIN',
+
+            # === Django-Axes: Brute-force protection ===
+            **self._get_axes_settings(is_dev=True),
+
+            # === Authentication backends (django-axes + default) ===
+            'AUTHENTICATION_BACKENDS': [
+                'axes.backends.AxesStandaloneBackend',  # django-axes must be first
+                'django.contrib.auth.backends.ModelBackend',  # Default Django auth
+            ],
         }
 
     def _prod_mode_universal(self, security_domains: List[str]) -> Dict[str, Any]:
@@ -154,12 +168,19 @@ class SecurityBuilder:
 
         normalized = self._normalize_domains(security_domains)
 
+        # Check if localhost is in security_domains for universal CORS regex
+        has_localhost = any(
+            domain in ('localhost', '127.0.0.1')
+            for domain in security_domains
+        )
+
         return {
             # === CORS: Only security_domains ===
             # Docker-to-Docker requests don't have Origin header - CORS doesn't apply
             'CORS_ALLOW_ALL_ORIGINS': False,
             'CORS_ALLOW_CREDENTIALS': True,
             'CORS_ALLOWED_ORIGINS': normalized['cors_origins'],
+            'CORS_ALLOWED_ORIGIN_REGEXES': self._get_localhost_cors_regexes() if has_localhost else [],
             'CORS_ALLOW_HEADERS': self.config.cors_allow_headers,
 
             # === ALLOWED_HOSTS: security_domains + Docker patterns ===
@@ -167,7 +188,9 @@ class SecurityBuilder:
             'ALLOWED_HOSTS': self._get_prod_allowed_hosts(normalized['allowed_hosts']),
 
             # === CSRF: Only security_domains ===
-            'CSRF_TRUSTED_ORIGINS': normalized['csrf_origins'],
+            'CSRF_TRUSTED_ORIGINS': normalized['csrf_origins'] + (
+                self._get_localhost_csrf_origins() if has_localhost else []
+            ),
 
             # === Security: All enabled ===
             'SECURE_SSL_REDIRECT': self._should_enable_ssl_redirect(),
@@ -179,6 +202,15 @@ class SecurityBuilder:
             'SECURE_CONTENT_TYPE_NOSNIFF': True,
             'SECURE_BROWSER_XSS_FILTER': True,
             'X_FRAME_OPTIONS': 'DENY',
+
+            # === Django-Axes: Brute-force protection ===
+            **self._get_axes_settings(is_dev=False),
+
+            # === Authentication backends (django-axes + default) ===
+            'AUTHENTICATION_BACKENDS': [
+                'axes.backends.AxesStandaloneBackend',  # django-axes must be first
+                'django.contrib.auth.backends.ModelBackend',  # Default Django auth
+            ],
         }
 
     def _get_prod_allowed_hosts(self, domain_hosts: List[str]) -> List[str]:
@@ -308,6 +340,241 @@ class SecurityBuilder:
 
         return origins
 
+    def _get_localhost_cors_regexes(self) -> List[str]:
+        """
+        Universal localhost CORS regex for ANY port.
+
+        When localhost/127.0.0.1 is in security_domains, allow all ports via regex.
+        This is much simpler than maintaining a list of specific ports.
+
+        Matches:
+        - http://localhost:3000
+        - http://localhost:8000
+        - http://127.0.0.1:7301
+        - Any other localhost port
+
+        Returns:
+            List of regex patterns for CORS_ALLOWED_ORIGIN_REGEXES
+        """
+        return [
+            r'^http://localhost:\d+$',      # localhost with any port
+            r'^http://127\.0\.0\.1:\d+$',   # 127.0.0.1 with any port
+        ]
+
+    def _get_localhost_csrf_origins(self) -> List[str]:
+        """
+        Localhost CSRF origins with common development ports.
+
+        CSRF doesn't support regex, so we need to list specific ports.
+        Covers standard development tools and frameworks.
+
+        Note: CORS uses regex for ALL ports via CORS_ALLOWED_ORIGIN_REGEXES.
+        CSRF is more limited - only these common ports are whitelisted.
+
+        Returns:
+            List of localhost origins with common ports for CSRF
+        """
+        # Common development ports (framework defaults)
+        dev_ports = [
+            # Frontend frameworks
+            3000, 3001, 3002,  # React/Next.js
+            5173, 5174,        # Vite
+            8080, 8081,        # Vue/Spring Boot
+            4200,              # Angular
+            # Backend servers
+            8000, 8001, 8002,  # Django
+            5000,              # Flask
+            4000,              # Express
+        ]
+
+        origins = []
+        for port in dev_ports:
+            origins.extend([
+                f"http://localhost:{port}",
+                f"http://127.0.0.1:{port}",
+            ])
+
+        return origins
+
+    def _get_axes_settings(self, is_dev: bool) -> Dict[str, Any]:
+        """
+        Get Django-Axes settings (custom config or smart defaults).
+
+        Args:
+            is_dev: Whether running in development mode
+
+        Returns:
+            Dictionary with Django-Axes settings
+        """
+        # If user provided custom AxesConfig, use it
+        if self.config.axes:
+            return self.config.axes.to_django_settings(
+                is_production=self.config.is_production,
+                debug=self.config.debug
+            )
+
+        # Otherwise, use smart defaults
+        return self._get_default_axes_settings(is_dev)
+
+    def _get_default_axes_settings(self, is_dev: bool) -> Dict[str, Any]:
+        """
+        Get default Django-Axes settings based on environment.
+
+        Args:
+            is_dev: Whether running in development mode
+
+        Returns:
+            Dictionary with default Django-Axes settings
+        """
+        if is_dev:
+            return {
+                'AXES_ENABLED': True,
+                'AXES_FAILURE_LIMIT': 10,  # More attempts in dev
+                'AXES_COOLOFF_TIME': 1,  # 1 hour lockout
+                'AXES_LOCK_OUT_AT_FAILURE': True,
+                'AXES_RESET_ON_SUCCESS': True,
+                # AXES_ONLY_USER_FAILURES deprecated in 8.0
+                'AXES_LOCKOUT_TEMPLATE': None,  # Use default lockout response
+                'AXES_LOCKOUT_URL': None,  # No custom lockout URL
+                'AXES_VERBOSE': True,  # Log lockout events in dev
+                'AXES_ENABLE_ACCESS_FAILURE_LOG': True,
+                'AXES_IPWARE_PROXY_COUNT': 1,
+                'AXES_IPWARE_META_PRECEDENCE_ORDER': [
+                    'HTTP_X_FORWARDED_FOR',
+                    'HTTP_X_REAL_IP',
+                    'REMOTE_ADDR',
+                ],
+            }
+        else:
+            return {
+                'AXES_ENABLED': True,
+                'AXES_FAILURE_LIMIT': 5,  # Stricter limit in production
+                'AXES_COOLOFF_TIME': 24,  # 24 hours lockout in production
+                'AXES_LOCK_OUT_AT_FAILURE': True,
+                'AXES_RESET_ON_SUCCESS': True,
+                # AXES_ONLY_USER_FAILURES deprecated in 8.0
+                'AXES_LOCKOUT_TEMPLATE': None,  # Use default lockout response
+                'AXES_LOCKOUT_URL': None,  # No custom lockout URL
+                'AXES_VERBOSE': False,  # Less verbose logging in production
+                'AXES_ENABLE_ACCESS_FAILURE_LOG': True,  # Log failures for security audit
+                # Proxy/Cloudflare support - get real IP from X-Forwarded-For
+                'AXES_IPWARE_PROXY_COUNT': 1,  # Number of proxies between client and server
+                'AXES_IPWARE_META_PRECEDENCE_ORDER': [
+                    'HTTP_X_FORWARDED_FOR',  # Cloudflare, nginx, traefik
+                    'HTTP_X_REAL_IP',        # Alternative proxy header
+                    'REMOTE_ADDR',           # Fallback to direct connection
+                ],
+            }
+
+    def _get_all_security_domains(self) -> List[str]:
+        """
+        Get all security domains including auto-extracted from api_url and site_url.
+
+        Automatically extracts domains from:
+        - config.security_domains (user-defined)
+        - config.api_url (backend URL)
+        - config.site_url (frontend URL)
+
+        Smart deduplication by hostname:port (ignoring protocol differences).
+
+        Returns:
+            List of all unique security domains
+
+        Example:
+            >>> config = DjangoConfig(
+            ...     api_url="https://api.example.com",
+            ...     site_url="https://example.com",
+            ...     security_domains=["localhost"]
+            ... )
+            >>> builder = SecurityBuilder(config)
+            >>> domains = builder._get_all_security_domains()
+            >>> len([d for d in domains if 'api.example.com' in d])
+            1
+            >>> len([d for d in domains if 'example.com' in d and 'api' not in d])
+            1
+        """
+        domains = list(self.config.security_domains)
+
+        # Extract domain from api_url
+        if self.config.api_url:
+            try:
+                parsed = urlparse(self.config.api_url)
+                if parsed.netloc:
+                    # Add full URL with protocol and port if present
+                    if parsed.port:
+                        domains.append(f"{parsed.scheme}://{parsed.hostname}:{parsed.port}")
+                    else:
+                        domains.append(f"{parsed.scheme}://{parsed.hostname}")
+            except Exception:
+                pass  # Ignore parsing errors
+
+        # Extract domain from site_url
+        if self.config.site_url:
+            try:
+                parsed = urlparse(self.config.site_url)
+                if parsed.netloc:
+                    # Add full URL with protocol and port if present
+                    if parsed.port:
+                        domains.append(f"{parsed.scheme}://{parsed.hostname}:{parsed.port}")
+                    else:
+                        domains.append(f"{parsed.scheme}://{parsed.hostname}")
+            except Exception:
+                pass  # Ignore parsing errors
+
+        # Smart deduplication: track by hostname:port, keep first occurrence with protocol
+        seen_hostports = {}  # hostname:port -> full domain string
+        unique_domains = []
+
+        for domain in domains:
+            if not domain or not domain.strip():
+                continue
+
+            domain = domain.strip()
+
+            # Normalize for comparison: parse to get hostname:port key
+            try:
+                # Add protocol if missing for parsing
+                if not domain.startswith(("http://", "https://")):
+                    parse_domain = f"http://{domain}"
+                else:
+                    parse_domain = domain
+
+                parsed = urlparse(parse_domain)
+                hostname = (parsed.hostname or parsed.netloc.split(':')[0]).lower()  # Lowercase for case-insensitive comparison
+                port = parsed.port
+
+                # Create unique key: hostname:port or just hostname (lowercase for case-insensitivity)
+                if port:
+                    hostport_key = f"{hostname}:{port}"
+                else:
+                    hostport_key = hostname
+
+                # Only add if we haven't seen this hostname:port combination
+                if hostport_key not in seen_hostports:
+                    # Normalize domain to lowercase but preserve original format (with/without protocol)
+                    # Reconstruct normalized domain
+                    if domain.startswith(("http://", "https://")):
+                        # Has protocol - normalize hostname part only
+                        if port:
+                            normalized_domain = f"{parsed.scheme}://{hostname}:{port}"
+                        else:
+                            normalized_domain = f"{parsed.scheme}://{hostname}"
+                    else:
+                        # No protocol - just lowercase the whole thing
+                        normalized_domain = domain.lower()
+
+                    seen_hostports[hostport_key] = normalized_domain
+                    unique_domains.append(normalized_domain)
+
+            except Exception:
+                # If parsing fails, use simple string deduplication with lowercase
+                domain_lower = domain.lower()
+                if domain_lower not in seen_hostports.values():
+                    seen_hostports[domain_lower] = domain_lower
+                    unique_domains.append(domain_lower)
+
+        return unique_domains
+
     def _normalize_domains(self, domains: List[str]) -> Dict[str, List[str]]:
         """
         Normalize domains in ANY format.
@@ -317,6 +584,7 @@ class SecurityBuilder:
         - "https://api.example.com" → https://api.example.com (as is)
         - "http://staging.com:8080" → http://staging.com:8080 (as is)
         - "192.168.1.10" → http://192.168.1.10
+        - "localhost" → http://localhost (regex handles all ports via CORS_ALLOWED_ORIGIN_REGEXES)
 
         Args:
             domains: List of domains in any format

django_cfg/core/constants.py

@@ -40,9 +40,12 @@ DEFAULT_APPS: List[str] = [
     "django_extensions",
     "constance",
     "constance.backends.database",
+    # Security
+    "axes",  # django-axes for brute-force protection
     # Django CFG Core
     "django_cfg",
     "django_cfg.modules.django_client",
+    "django_cfg.modules.django_admin",
 ]
 
 # Default middleware stack
@@ -54,6 +57,8 @@ DEFAULT_MIDDLEWARE: List[str] = [
     "django.middleware.common.CommonMiddleware",
     "django.middleware.csrf.CsrfViewMiddleware",
     "django.contrib.auth.middleware.AuthenticationMiddleware",
+    # Security: django-axes must be after AuthenticationMiddleware
+    "axes.middleware.AxesMiddleware",
     "django.contrib.messages.middleware.MessageMiddleware",
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
 ]

django_cfg/core/debug/README.md

@@ -0,0 +1,116 @@
+# Django-CFG Debug Utilities
+
+Debug utilities to help troubleshoot Django-CFG issues.
+
+## Warnings Debug Helper
+
+Shows full stack traceback for specific warnings to help identify their source.
+
+### Quick Start
+
+**Method 1: Via Config (Recommended)**
+
+```python
+# In your config.py
+from django_cfg import DjangoConfig
+
+class MyConfig(DjangoConfig):
+    project_name: str = "My Project"
+    debug_warnings: bool = True  # ← Enable warnings traceback
+```
+
+**Method 2: Via Environment Variable**
+
+```bash
+export DJANGO_CFG_DEBUG_WARNINGS=1
+python manage.py runserver
+```
+
+This will show full traceback for:
+- RuntimeWarnings about database access during app initialization
+- APPS_NOT_READY warnings
+- Other app initialization warnings
+
+### Example Output
+
+```
+================================================================================
+⚠️  WARNING TRACEBACK (to help find the source)
+================================================================================
+  File "/path/to/your/code/apps.py", line 42, in ready
+    self.setup_database()
+  File "/path/to/your/code/apps.py", line 55, in setup_database
+    MyModel.objects.all()
+    ^^^^^^^^^^^^^^^^^^^^
+
+--------------------------------------------------------------------------------
+⚠️  WARNING MESSAGE:
+/usr/lib/python3.12/site-packages/django/db/backends/utils.py:98: RuntimeWarning:
+Accessing the database during app initialization is discouraged. To fix this
+warning, avoid executing queries in AppConfig.ready() or when your app modules
+are imported.
+================================================================================
+```
+
+### Manual Usage
+
+```python
+# In your manage.py or wsgi.py, BEFORE django.setup():
+from django_cfg.core.debug import setup_warnings_debug
+
+# Enable with default settings
+setup_warnings_debug(enabled=True)
+
+# Or customize:
+setup_warnings_debug(
+    enabled=True,
+    categories=[RuntimeWarning, DeprecationWarning],
+    patterns=['.*database.*', '.*deprecated.*']
+)
+```
+
+### Common Issues Found
+
+1. **Database access in AppConfig.ready()**
+   ```python
+   # ❌ Bad
+   def ready(self):
+       from .models import MyModel
+       MyModel.objects.create(...)
+
+   # ✅ Good - use post_migrate signal
+   def ready(self):
+       from django.db.models.signals import post_migrate
+       post_migrate.connect(self.setup_data, sender=self)
+   ```
+
+2. **Model queries at module level**
+   ```python
+   # ❌ Bad - runs during import
+   from .models import MyModel
+   DEFAULT_SETTINGS = MyModel.objects.first()
+
+   # ✅ Good - lazy evaluation
+   def get_default_settings():
+       from .models import MyModel
+       return MyModel.objects.first()
+   ```
+
+3. **Database connection in __init__.py**
+   ```python
+   # ❌ Bad
+   from django.db import connection
+   cursor = connection.cursor()
+
+   # ✅ Good - move to views/services
+   ```
+
+### Disabling
+
+Simply unset or set to 0:
+
+```bash
+export DJANGO_CFG_DEBUG_WARNINGS=0
+# or
+unset DJANGO_CFG_DEBUG_WARNINGS
+```

django_cfg/core/debug/__init__.py

@@ -0,0 +1,7 @@
+"""
+Debug utilities for Django-CFG.
+"""
+
+from .warnings_helper import setup_warnings_debug
+
+__all__ = ['setup_warnings_debug']