django-cfg 1.4.48__py3-none-any.whl → 1.5.7__py3-none-any.whl

django_cfg/management/commands/superuser.py

@@ -3,9 +3,6 @@ Superuser Command for Django Config Toolkit
 Enhanced superuser creation with validation and configuration.
 """
 
-from datetime import datetime
-from pathlib import Path
-
 import questionary
 from django.contrib.auth import get_user_model
 from django.core.exceptions import ValidationError
@@ -231,9 +228,6 @@ class Command(BaseCommand):
                 is_active=True
             )
 
-            # Save user details to file
-            self.save_superuser_details(user, user_data['password'])
-
             self.stdout.write(self.style.SUCCESS('✅ Superuser created successfully!'))
             self.stdout.write(f'👤 Username: {user.username}')
             self.stdout.write(f'📧 Email: {user.email}')
@@ -247,32 +241,6 @@ class Command(BaseCommand):
         except Exception as e:
             self.stdout.write(self.style.ERROR(f'❌ Error creating superuser: {e}'))
 
-    def save_superuser_details(self, user, password):
-        """Save superuser details to file"""
-        # Create superusers directory
-        superusers_dir = Path('superusers')
-        superusers_dir.mkdir(exist_ok=True)
-
-        # Create details file
-        timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
-        filename = f"superuser_{user.username}_{timestamp}.txt"
-        filepath = superusers_dir / filename
-
-        with open(filepath, 'w') as f:
-            f.write("Superuser Details\n")
-            f.write("================\n\n")
-            f.write(f"Username: {user.username}\n")
-            f.write(f"Email: {user.email}\n")
-            f.write(f"First Name: {user.first_name}\n")
-            f.write(f"Is Superuser: {user.is_superuser}\n")
-            f.write(f"Is Staff: {user.is_staff}\n")
-            f.write(f"Is Active: {user.is_active}\n")
-            f.write(f"Date Created: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n")
-            f.write("\n⚠️  IMPORTANT: Store this password securely!\n")
-            f.write(f"Password: {password}\n")
-
-        self.stdout.write(f'💾 Superuser details saved to: {filepath}')
-
     def show_next_steps(self):
         """Show next steps after creating superuser"""
         self.stdout.write(self.style.SUCCESS('\n🎉 Next Steps:'))

django_cfg/middleware/README.md

@@ -5,6 +5,19 @@ Custom Django middleware components for Django CFG applications.
 ## 📋 Contents
 
 - [UserActivityMiddleware](#useractivitymiddleware) - User activity tracking
+- [Admin Login Notifications](#admin-login-notifications) - Real-time Telegram alerts for admin access
+
+## JWT Token Injection for Next.js Apps
+
+**Note:** JWT token injection is now handled by `NextJSStaticView` in `apps/frontend/views.py`, not by middleware.
+
+This provides better security by limiting JWT injection scope to Next.js applications only.
+
+### 📖 Full Documentation
+
+See [`/apps/frontend/JWT_AUTO_INJECTION.md`](../apps/frontend/JWT_AUTO_INJECTION.md) for complete JWT injection documentation.
+
+---
 
 ## UserActivityMiddleware
 
@@ -158,3 +171,362 @@ class MyProjectConfig(DjangoConfig):
 # GET /api/users/?format=json
 # PUT /cfg/newsletter/subscribe/
 ```
+
+---
+
+## Admin Login Notifications
+
+Real-time Telegram notifications for admin panel access monitoring. Automatically sends alerts for successful logins, failed attempts, and account lockouts.
+
+### ✨ Features
+
+- ✅ **Successful admin logins** - Info notifications with user details
+- ✅ **Failed login attempts** - Warning notifications (django-axes integration)
+- ✅ **Account lockouts** - Error alerts for brute-force protection
+- ✅ **Real IP detection** - Cloudflare/nginx/traefik support
+- ✅ **Role identification** - Superuser vs staff differentiation
+- ✅ **Zero configuration** - Works automatically when Telegram is configured
+
+### 🚀 Automatic Integration
+
+Admin login notifications activate automatically when Telegram is configured:
+
+```python
+# config.py
+class MyConfig(DjangoConfig):
+    # Configure Telegram
+    telegram: TelegramConfig = TelegramConfig(
+        bot_token="your-bot-token",
+        chat_id=123456789,
+    )
+
+    # That's it! Admin login notifications are now active
+```
+
+### 📱 Notification Types
+
+#### 1. Successful Login (Info)
+
+**Superuser login:**
+```
+👑 Admin Login (Superuser)
+
+user: admin@example.com
+username: admin
+role: Superuser
+is_superuser: true
+login_time: 2025-10-21 15:30:45 UTC
+ip_address: 192.168.1.100
+user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...
+user_id: 1
+```
+
+**Staff login:**
+```
+🔐 Admin Login (Staff)
+
+user: staff@example.com
+username: staff_user
+role: Staff
+is_superuser: false
+login_time: 2025-10-21 15:32:10 UTC
+ip_address: 192.168.1.101
+user_agent: Mozilla/5.0...
+user_id: 5
+```
+
+#### 2. Failed Login Attempt (Warning)
+
+```
+⚠️ Failed Admin Login Attempt
+
+username: admin
+ip_address: 203.0.113.45
+time: 2025-10-21 15:35:22 UTC
+user_agent: Mozilla/5.0...
+path: /admin/login/
+```
+
+#### 3. Account Lockout (Error)
+
+```
+🚨 Admin Account LOCKED OUT
+
+username: admin
+ip_address: 203.0.113.45
+time: 2025-10-21 15:36:10 UTC
+reason: Too many failed login attempts
+action_required: Manual unlock required in admin panel or via axes_reset command
+```
+
+### 🔧 How It Works
+
+The module uses **Django signals** (not traditional middleware):
+
+1. **`user_logged_in` signal** - Catches all successful logins
+   - Filters for `/admin/` paths only
+   - Checks `is_staff` or `is_superuser` permissions
+   - Sends Telegram info notification
+
+2. **`user_login_failed` signal** - Catches failed attempts (django-axes)
+   - Only for admin panel paths
+   - Sends warning notification
+
+3. **`user_locked_out` signal** - Catches lockouts (django-axes)
+   - Critical security alert
+   - Sends error notification
+
+### 🌐 Proxy Support
+
+Automatically extracts real client IP through proxies:
+
+**Header precedence** (matches AxesConfig):
+1. `HTTP_CF_CONNECTING_IP` - Cloudflare real IP
+2. `HTTP_X_FORWARDED_FOR` - Nginx/Traefik proxy
+3. `HTTP_X_REAL_IP` - Alternative proxy header
+4. `REMOTE_ADDR` - Direct connection
+
+**Example with Cloudflare:**
+```
+Client (203.0.113.45) → Cloudflare → nginx → Django
+
+Headers received:
+- HTTP_CF_CONNECTING_IP: 203.0.113.45  ← Real client IP
+- HTTP_X_FORWARDED_FOR: 203.0.113.45, 104.21.1.1
+- REMOTE_ADDR: 172.18.0.1
+
+Detected IP: 203.0.113.45 ✅
+```
+
+### 🔒 Security Benefits
+
+1. **Immediate attack detection** - Real-time alerts for suspicious activity
+2. **Brute-force monitoring** - Track failed login patterns
+3. **Lockout notifications** - Know when accounts are locked
+4. **IP tracking** - Identify attack sources
+5. **Role awareness** - Monitor superuser vs staff access
+
+### 📊 Integration with Django-Axes
+
+Works seamlessly with django-axes brute-force protection:
+
+```python
+# config.py
+class MyConfig(DjangoConfig):
+    # Django-Axes configuration
+    axes: AxesConfig = AxesConfig(
+        failure_limit=5,      # 5 failed attempts
+        cooloff_time=24,      # 24 hour lockout
+    )
+
+    # Telegram configuration
+    telegram: TelegramConfig = TelegramConfig(
+        bot_token="your-token",
+        chat_id=123456789,
+    )
+
+    # Notifications work automatically:
+    # 1. Failed attempt → Telegram warning
+    # 2. 5th failed attempt → Account locked
+    # 3. Lockout → Telegram error alert
+```
+
+### 🎯 Admin Panel Only
+
+Notifications are **only sent for admin panel access**:
+
+✅ **Monitored paths:**
+- `/admin/login/`
+- `/admin/`
+- `/admin/accounts/customuser/`
+- Any path starting with `/admin/`
+
+❌ **Not monitored:**
+- `/api/auth/login/` - API login
+- `/cfg/accounts/otp/` - OTP login
+- Regular user logins
+
+### 🔕 Disabling Notifications
+
+To disable admin login notifications:
+
+```python
+# Option 1: Disable Telegram entirely
+telegram: Optional[TelegramConfig] = None
+
+# Option 2: Set bot_token to empty
+telegram: TelegramConfig = TelegramConfig(
+    bot_token="",  # Notifications disabled
+    chat_id=0,
+)
+```
+
+### 🧪 Testing
+
+Test admin login notifications:
+
+```bash
+# 1. Test successful login
+# - Login to admin panel at /admin/
+# - Check Telegram for "🔐 Admin Login" or "👑 Admin Login (Superuser)"
+
+# 2. Test failed login
+# - Try wrong password at /admin/login/
+# - Check Telegram for "⚠️ Failed Admin Login Attempt"
+
+# 3. Test lockout
+# - Fail login 5 times (default AXES_FAILURE_LIMIT)
+# - Check Telegram for "🚨 Admin Account LOCKED OUT"
+
+# 4. Test unlock
+python manage.py axes_reset username admin
+# Login again - should get success notification
+```
+
+### 📝 Logging
+
+All notifications are logged:
+
+```python
+# settings.py or configure logging
+LOGGING = {
+    'loggers': {
+        'django_cfg.middleware.admin_notifications': {
+            'level': 'INFO',
+            'handlers': ['console'],
+        },
+    },
+}
+```
+
+**Log output:**
+```
+INFO Admin login notification sent for admin@example.com from 192.168.1.100
+WARNING Failed admin login attempt: admin from 203.0.113.45
+ERROR Admin account locked out: admin from 203.0.113.45
+```
+
+### 🚨 Important Notes
+
+1. **Requires Telegram** - Only works when TelegramConfig is configured
+2. **Django-Axes optional** - Failed login/lockout notifications require django-axes
+3. **Signal-based** - Not a traditional middleware class, uses Django signals
+4. **Auto-registers** - Signals register automatically on import
+5. **Fail-safe** - Notification errors don't break login flow
+
+### 💡 Usage Examples
+
+**Example 1: Basic setup**
+```python
+# config.py
+class MyConfig(DjangoConfig):
+    telegram: TelegramConfig = TelegramConfig(
+        bot_token=env.telegram.bot_token,
+        chat_id=env.telegram.chat_id,
+    )
+
+# Done! Admin logins now send Telegram notifications
+```
+
+**Example 2: With django-axes**
+```python
+# config.py
+class MyConfig(DjangoConfig):
+    # Brute-force protection
+    axes: AxesConfig = AxesConfig(
+        failure_limit=3,
+        cooloff_time=48,
+    )
+
+    # Telegram notifications
+    telegram: TelegramConfig = TelegramConfig(
+        bot_token=env.telegram.bot_token,
+        chat_id=env.telegram.chat_id,
+    )
+
+# Get notifications for:
+# ✅ Successful logins
+# ✅ Failed attempts
+# ✅ Lockouts
+```
+
+**Example 3: Production monitoring**
+```python
+# config.py
+class ProdConfig(DjangoConfig):
+    debug: bool = False
+    security_domains: list = ["myapp.com"]
+
+    # Strict brute-force protection
+    axes: AxesConfig = AxesConfig(
+        failure_limit=3,      # Only 3 attempts
+        cooloff_time=72,      # 72 hour lockout
+        allowed_ips=[         # Whitelist office IPs
+            '192.168.1.0/24',
+        ],
+    )
+
+    # Telegram security monitoring
+    telegram: TelegramConfig = TelegramConfig(
+        bot_token=env.telegram.bot_token,
+        chat_id=env.telegram.security_chat_id,  # Dedicated security channel
+    )
+
+# Production security monitoring:
+# 🔐 Know who accesses admin panel
+# ⚠️ Track suspicious login attempts
+# 🚨 Get immediate lockout alerts
+```
+
+### 🔍 Troubleshooting
+
+**Problem: No notifications sent**
+
+1. Check Telegram configuration:
+```python
+from django_cfg.modules.django_telegram import DjangoTelegram
+
+telegram = DjangoTelegram()
+print(telegram.is_configured)  # Should be True
+print(telegram.get_config_info())
+```
+
+2. Test Telegram manually:
+```python
+from django_cfg.modules.django_telegram import DjangoTelegram
+
+DjangoTelegram.send_info("Test", {"message": "Testing admin notifications"})
+```
+
+3. Check logs:
+```bash
+# Enable DEBUG logging
+tail -f logs/django.log | grep admin_notifications
+```
+
+**Problem: Wrong IP address**
+
+Configure proxy settings:
+```python
+# config.py
+axes: AxesConfig = AxesConfig(
+    ipware_proxy_count=1,  # Adjust based on proxy layers
+    ipware_meta_precedence_order=[
+        'HTTP_CF_CONNECTING_IP',  # Add your proxy header
+        'HTTP_X_FORWARDED_FOR',
+        'REMOTE_ADDR',
+    ],
+)
+```
+
+**Problem: Too many notifications**
+
+Notifications are sent once per login. If you're getting duplicates:
+- Check for multiple middleware/signal registrations
+- Verify django-axes is not sending duplicate signals
+
+### 📚 See Also
+
+- [Django-Axes Configuration](../fundamentals/configuration/security.md#django-axes-brute-force-protection)
+- [Telegram Module](../modules/django_telegram)
+- [Security Settings](../fundamentals/configuration/security.md)

django_cfg/middleware/__init__.py

@@ -6,6 +6,12 @@ Provides middleware components for Django CFG applications.
 
 from .user_activity import UserActivityMiddleware
 
+# Import admin_notifications to register signal handlers
+# This module contains Django signal receivers for admin login monitoring
+# No middleware class needed - signals auto-register on import
+from . import admin_notifications  # noqa: F401
+
 __all__ = [
     'UserActivityMiddleware',
+    'admin_notifications',
 ]

django_cfg/middleware/admin_notifications.py

@@ -0,0 +1,206 @@
+"""
+Admin Login Notifications Middleware for Django CFG
+
+Monitors admin panel access and sends real-time Telegram notifications for:
+- Successful admin logins (staff and superusers)
+- Failed login attempts (via django-axes integration)
+- Account lockouts after multiple failed attempts
+
+Integrates with:
+- Django's built-in auth signals (user_logged_in)
+- Django-Axes signals (user_login_failed, user_locked_out)
+- Django CFG's Telegram notification service
+"""
+
+import logging
+
+from django.contrib.auth.signals import user_logged_in
+from django.dispatch import receiver
+from django.utils import timezone
+
+from django_cfg.modules.django_telegram import DjangoTelegram
+
+logger = logging.getLogger(__name__)
+
+
+def get_client_ip(request):
+    """
+    Extract real client IP address from request.
+
+    Handles proxy scenarios (Cloudflare, nginx, traefik) by checking headers
+    in order of precedence. Matches the order used in AxesConfig.
+
+    Args:
+        request: Django HttpRequest object
+
+    Returns:
+        str: Client IP address or 'Unknown' if not found
+    """
+    # Header precedence order (matches AxesConfig defaults)
+    headers = [
+        'HTTP_CF_CONNECTING_IP',     # Cloudflare real IP
+        'HTTP_X_FORWARDED_FOR',      # Nginx/Traefik proxy
+        'HTTP_X_REAL_IP',            # Alternative proxy header
+        'REMOTE_ADDR',               # Direct connection
+    ]
+
+    for header in headers:
+        value = request.META.get(header)
+        if value:
+            # X-Forwarded-For can contain multiple IPs (client, proxy1, proxy2)
+            # Take the first one (real client IP)
+            return value.split(',')[0].strip()
+
+    return 'Unknown'
+
+
+# === SUCCESSFUL ADMIN LOGINS ===
+
+@receiver(user_logged_in)
+def notify_admin_login_success(sender, request, user, **kwargs):
+    """
+    Send Telegram notification on successful admin panel login.
+
+    Triggers only for:
+    - Requests to /admin/ paths
+    - Users with staff or superuser permissions
+
+    Notification includes:
+    - User details (email, username, role)
+    - Login timestamp
+    - IP address (with proxy support)
+    - User agent
+
+    Args:
+        sender: Signal sender (User model)
+        request: HttpRequest object
+        user: Authenticated user instance
+        **kwargs: Additional signal arguments
+    """
+    # Only monitor admin panel logins
+    if not request or not request.path.startswith('/admin/'):
+        return
+
+    # Only monitor staff/superuser access
+    if not (user.is_staff or user.is_superuser):
+        return
+
+    # Extract request metadata
+    ip_address = get_client_ip(request)
+    user_agent = request.META.get('HTTP_USER_AGENT', 'Unknown')
+
+    try:
+        # Determine user role and notification style
+        emoji = "👑" if user.is_superuser else "🔐"
+        role = "Superuser" if user.is_superuser else "Staff"
+
+        # Send Telegram notification
+        DjangoTelegram.send_info(
+            f"{emoji} Admin Login ({role})",
+            {
+                "user": user.email,
+                "username": user.username,
+                "role": role,
+                "is_superuser": user.is_superuser,
+                "login_time": timezone.now().strftime("%Y-%m-%d %H:%M:%S UTC"),
+                "ip_address": ip_address,
+                "user_agent": user_agent[:100],  # Truncate long user agents
+                "user_id": user.id,
+            }
+        )
+        logger.info(f"Admin login notification sent for {user.email} from {ip_address}")
+
+    except Exception as e:
+        # Don't break login flow if notification fails
+        logger.error(f"Failed to send admin login notification: {e}")
+
+
+# === FAILED LOGIN ATTEMPTS (Django-Axes Integration) ===
+
+try:
+    from axes.signals import user_login_failed, user_locked_out
+
+    @receiver(user_login_failed)
+    def notify_failed_admin_login(sender, credentials, request, **kwargs):
+        """
+        Send Telegram warning on failed admin login attempt.
+
+        Integrates with django-axes to track failed authentication attempts.
+        Helps identify brute-force attacks and unauthorized access attempts.
+
+        Args:
+            sender: Signal sender
+            credentials: Dict with login credentials (username, password)
+            request: HttpRequest object
+            **kwargs: Additional signal arguments
+        """
+        # Only monitor admin panel
+        if not request or not request.path.startswith('/admin/'):
+            return
+
+        ip_address = get_client_ip(request)
+        username = credentials.get('username', 'Unknown')
+
+        try:
+            DjangoTelegram.send_warning(
+                "⚠️ Failed Admin Login Attempt",
+                {
+                    "username": username,
+                    "ip_address": ip_address,
+                    "time": timezone.now().strftime("%Y-%m-%d %H:%M:%S UTC"),
+                    "user_agent": request.META.get('HTTP_USER_AGENT', 'Unknown')[:100],
+                    "path": request.path,
+                }
+            )
+            logger.warning(f"Failed admin login attempt: {username} from {ip_address}")
+
+        except Exception as e:
+            logger.error(f"Failed to send failed login notification: {e}")
+
+
+    @receiver(user_locked_out)
+    def notify_admin_lockout(sender, request, credentials, **kwargs):
+        """
+        Send Telegram alert when admin account is locked out.
+
+        Triggered by django-axes after multiple failed login attempts.
+        Critical security alert indicating possible attack.
+
+        Args:
+            sender: Signal sender
+            request: HttpRequest object
+            credentials: Dict with login credentials
+            **kwargs: Additional signal arguments
+        """
+        # Only monitor admin panel
+        if not request or not request.path.startswith('/admin/'):
+            return
+
+        ip_address = get_client_ip(request)
+        username = credentials.get('username', 'Unknown')
+
+        try:
+            DjangoTelegram.send_error(
+                "🚨 Admin Account LOCKED OUT",
+                {
+                    "username": username,
+                    "ip_address": ip_address,
+                    "time": timezone.now().strftime("%Y-%m-%d %H:%M:%S UTC"),
+                    "reason": "Too many failed login attempts",
+                    "action_required": "Manual unlock required in admin panel or via axes_reset command",
+                }
+            )
+            logger.error(f"Admin account locked out: {username} from {ip_address}")
+
+        except Exception as e:
+            logger.error(f"Failed to send lockout notification: {e}")
+
+except ImportError:
+    # Django-Axes not installed - skip failed login monitoring
+    logger.info("Django-Axes not installed - failed login notifications disabled")
+
+
+__all__ = [
+    "get_client_ip",
+    "notify_admin_login_success",
+]