endoreg-db 0.8.9.32__py3-none-any.whl

endoreg_db/config/settings/base.py

@@ -0,0 +1,148 @@
+import os
+from pathlib import Path
+
+# Use centralized environment helpers
+from endoreg_db.config.env import env_bool, env_path
+
+
+# Small helper to coerce relative paths to absolute under BASE_DIR
+def _abs_under_base(path_str: str, default_relative: str) -> Path:
+    p = env_path(path_str, default_relative)
+    return p
+
+
+BASE_DIR = Path(__file__).parent.parent.parent.resolve()
+
+# Test assets directory (used in tests and utilities)
+ASSET_DIR = _abs_under_base("ASSET_DIR", "tests/assets")
+RUN_VIDEO_TESTS = env_bool("RUN_VIDEO_TESTS", False)
+
+# Internationalization
+LANGUAGE_CODE = "de"
+USE_I18N = True
+USE_TZ = True
+
+# Only support German and English
+LANGUAGES = [
+    ("de", "German"),
+    ("en", "English"),
+]
+
+#ROOT_URLCONF = 'endoreg_db.urls.root_urls'
+
+
+
+# Core apps
+INSTALLED_APPS = [
+    "endoreg_db.apps.EndoregDbConfig",
+    "django.contrib.auth",
+    "django.contrib.contenttypes",
+    "django.contrib.sessions",
+    "django.contrib.messages",
+    "django.contrib.staticfiles",
+    "rest_framework",
+]
+
+MIDDLEWARE = [
+    "django.middleware.security.SecurityMiddleware",
+    "whitenoise.middleware.WhiteNoiseMiddleware",
+    "django.contrib.sessions.middleware.SessionMiddleware",
+    "django.middleware.common.CommonMiddleware",
+    "django.middleware.csrf.CsrfViewMiddleware",
+    "django.contrib.auth.middleware.AuthenticationMiddleware",
+    "django.contrib.messages.middleware.MessageMiddleware",
+    "django.middleware.clickjacking.XFrameOptionsMiddleware",
+]
+
+# Use a distinct module name to avoid ambiguity and mount API under /api/
+ROOT_URLCONF = "endoreg_db.root_urls"
+DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
+TIME_ZONE = os.environ.get("TIME_ZONE", "Europe/Berlin")
+
+STATIC_URL = os.environ.get("STATIC_URL", "/static/")
+STATIC_ROOT = env_path("STATIC_ROOT", "staticfiles")
+
+# Media/storage root can be overridden from env (important when embedded)
+MEDIA_URL = os.environ.get("MEDIA_URL", "/media/")
+MEDIA_ROOT = env_path("STORAGE_DIR", "storage")
+
+# Caching: provide a default LocMem cache with explicit TIMEOUT for consistency
+CACHES = {
+    "default": {
+        "BACKEND": "django.core.cache.backends.locmem.LocMemCache",
+        "LOCATION": os.environ.get("CACHE_LOCATION", "endoreg-default-cache"),
+        "TIMEOUT": int(os.environ.get("CACHE_TIMEOUT", str(60 * 30))),  # 30 minutes default
+    }
+}
+
+REST_FRAMEWORK = {
+    "DEFAULT_THROTTLE_CLASSES": [
+        "rest_framework.throttling.UserRateThrottle",
+        "rest_framework.throttling.AnonRateThrottle",
+    ],
+    "DEFAULT_THROTTLE_RATES": {
+        "user": os.environ.get("DRF_THROTTLE_USER", "100/hour"),
+        "anon": os.environ.get("DRF_THROTTLE_ANON", "20/hour"),
+    },
+}
+
+TEMPLATES = [
+    {
+        "BACKEND": "django.template.backends.django.DjangoTemplates",
+        "DIRS": [],
+        "APP_DIRS": True,
+        "OPTIONS": {
+            "context_processors": [
+                "django.template.context_processors.debug",
+                "django.template.context_processors.request",
+                "django.contrib.auth.context_processors.auth",
+                "django.contrib.messages.context_processors.messages",
+            ],
+        },
+    },
+]
+
+TEST_LOGGER_NAMES = [
+    "tests",
+    "paths",
+    "raw_pdf",
+    "patient",
+    "default_objects",
+    "ffmpeg_wrapper",
+    # Video-pipeline modules
+    "endoreg_db.models.media.video.video_file",
+    "endoreg_db.models.media.video.video_file_anonymize",
+    "endoreg_db.models.media.video.pipe_1",
+    "endoreg_db.models.media.video.pipe_2",
+    "endoreg_db.utils.pipelines.process_video_dir",
+    "endoreg_db.models.metadata.sensitive_meta",
+]
+
+# TODO implement
+# LOGGING = get_logging_config(
+#     TEST_LOGGER_NAMES,
+#     file_log_level="INFO",
+#     console_log_level="WARNING",
+# )
+__all__ = [
+    "BASE_DIR",
+    "ASSET_DIR",
+    "RUN_VIDEO_TESTS",
+    "TEMPLATES",
+    "TEST_LOGGER_NAMES",
+    "REST_FRAMEWORK",
+    "INSTALLED_APPS",
+    "MIDDLEWARE",
+    "TIME_ZONE",
+    "STATIC_URL",
+    "STATIC_ROOT",
+    "MEDIA_URL",
+    "MEDIA_ROOT",
+    "CACHES",
+    "ROOT_URLCONF",
+    "DEFAULT_AUTO_FIELD",
+    "LANGUAGE_CODE",
+    "USE_I18N",
+    "USE_TZ",
+    "LANGUAGES",
+]

endoreg_db/config/settings/case_gen.py

@@ -0,0 +1,32 @@
+from .base import *  # noqa: F401,F403
+from .base import BASE_DIR
+from endoreg_db.config.env import env_bool, env_str
+from pathlib import Path
+
+# Persistent test DB
+DEFAULT_TEST_DB_PATH = BASE_DIR / "data" / "tests" / "db" / "test_db.sqlite3"
+TEST_DB_FILE = Path(env_str("TEST_DB_FILE", str(DEFAULT_TEST_DB_PATH)))
+TEST_DB_FILE.parent.mkdir(parents=True, exist_ok=True)
+
+DEBUG = env_bool("DJANGO_DEBUG", True)
+SECRET_KEY = env_str("DJANGO_SECRET_KEY", "test-insecure-key")
+ALLOWED_HOSTS = env_str("DJANGO_ALLOWED_HOSTS", "*").split(",")
+
+
+# Build DB config without redundant conditionals and avoid passing empty creds
+_db_config = {
+    "ENGINE": "django.db.backends.sqlite3",
+    "NAME": "casegen_db.sqlite3",
+}
+
+DATABASES = {"default": _db_config}
+
+# Configure cache with explicit TIMEOUT for tests
+CACHES = {
+    "default": {
+        "BACKEND": "django.core.cache.backends.locmem.LocMemCache",
+        "LOCATION": "endoreg-casegen-cache",
+        "TIMEOUT": int(env_str("TEST_CACHE_TIMEOUT", str(60 * 30))),
+    }
+}
+

endoreg_db/config/settings/dev.py

@@ -0,0 +1,108 @@
+from .base import BASE_DIR  # noqa: F401
+from endoreg_db.config.env import env_bool, env_str
+from . import keycloak as KEYCLOAK
+DEBUG = env_bool("DJANGO_DEBUG", True)
+SECRET_KEY = env_str("DJANGO_SECRET_KEY", "dev-insecure-key")
+ALLOWED_HOSTS = env_str("DJANGO_ALLOWED_HOSTS", "*").split(",")
+
+DB_ENGINE = env_str("DEV_DB_ENGINE", "django.db.backends.sqlite3")
+DB_NAME = env_str("DEV_DB_NAME", str(BASE_DIR / "dev_db.sqlite3"))
+DB_USER = env_str("DEV_DB_USER", "")
+DB_PASSWORD = env_str("DEV_DB_PASSWORD", "")
+DB_HOST = env_str("DEV_DB_HOST", "")
+DB_PORT = env_str("DEV_DB_PORT", "")
+
+# Build DB config without redundant conditionals and avoid passing empty creds
+_db_config = {
+    "ENGINE": DB_ENGINE,
+    "NAME": DB_NAME,
+}
+if not DB_ENGINE.endswith("sqlite3"):
+    if DB_USER:
+        _db_config["USER"] = DB_USER
+    if DB_PASSWORD:
+        _db_config["PASSWORD"] = DB_PASSWORD
+    if DB_HOST:
+        _db_config["HOST"] = DB_HOST
+    if DB_PORT:
+        _db_config["PORT"] = DB_PORT
+
+DATABASES = {"default": _db_config}
+
+# ---------------------------------------------------------------------------
+# Keycloak / OIDC integration for DEVELOPMENT settings
+# This file extends config/settings/base.py and imports a dedicated
+# Keycloak settings module (config/settings/keycloak.py) so all IdP
+# values live in one place.
+# ---------------------------------------------------------------------------
+
+from .base import *                 # bring in EVERYTHING from base.py first
+from . import keycloak as KEYCLOAK  # import our separate Keycloak config module
+
+# ---- Django app & middleware wiring ----------------------------------------
+# Add the mozilla-django-oidc app (gives /oidc/authenticate/, /oidc/callback/, /oidc/logout/)
+# and our small middleware that redirects browsers hitting /api/* to the OIDC login.
+# NOTE: AuthenticationMiddleware is already in base.py and MUST run before our middleware.
+INSTALLED_APPS = INSTALLED_APPS + KEYCLOAK.EXTRA_INSTALLED_APPS
+MIDDLEWARE     = MIDDLEWARE + KEYCLOAK.EXTRA_MIDDLEWARE
+
+# ---- Authentication backends -----------------------------------------------
+# Order matters: OIDC backend first (handles the OIDC callback, verifies ID token,
+# creates/updates the Django user, syncs Keycloak roles into Django Groups),
+# then the standard Django backend for compatibility/admin.
+AUTHENTICATION_BACKENDS = KEYCLOAK.AUTHENTICATION_BACKENDS
+
+# ---- DRF authentication + global permissions --------------------------------
+# DRF will try SessionAuthentication (browser session cookie) first,
+# then our KeycloakJWTAuthentication for API clients that send Bearer tokens.
+# Global permission chain:
+#   - EnvironmentAwarePermission: lets everything through in DEBUG, requires auth in prod
+#   - PolicyPermission: enforces REQUIRED_ROLES mapping (RBAC) from policy.py
+REST_FRAMEWORK.update({
+    "DEFAULT_AUTHENTICATION_CLASSES": KEYCLOAK.REST_FRAMEWORK_DEFAULT_AUTH,
+    "DEFAULT_PERMISSION_CLASSES": (
+        "endoreg_db.utils.permissions.EnvironmentAwarePermission",
+        "endoreg_db.authz.permissions.PolicyPermission",
+    ),
+})
+
+# ---- Django login/logout endpoints ------------------------------------------
+# Where to send users to initiate login (mozilla-django-oidc view),
+# where to land after login if no ?next=..., and where to land after a local logout.
+LOGIN_URL           = KEYCLOAK.LOGIN_URL
+LOGIN_REDIRECT_URL  = KEYCLOAK.LOGIN_REDIRECT_URL
+LOGOUT_REDIRECT_URL = KEYCLOAK.LOGOUT_REDIRECT_URL
+
+# ---- Provider coordinates (realm/client) ------------------------------------
+# Basic Keycloak coordinates that the OIDC library and our code use.
+KEYCLOAK_BASE_URL          = KEYCLOAK.KEYCLOAK_BASE_URL
+KEYCLOAK_REALM             = KEYCLOAK.KEYCLOAK_REALM
+OIDC_RP_CLIENT_ID          = KEYCLOAK.OIDC_RP_CLIENT_ID
+OIDC_RP_CLIENT_SECRET      = KEYCLOAK.OIDC_RP_CLIENT_SECRET  # TIP: use env var in prod
+OIDC_OP_DISCOVERY_ENDPOINT = KEYCLOAK.OIDC_OP_DISCOVERY_ENDPOINT
+
+# ---- Explicit OIDC endpoints (don’t rely only on discovery) -----------------
+# Explicitly set endpoints so /oidc/authenticate/ can build URLs even if discovery is skipped.
+OIDC_OP_AUTHORIZATION_ENDPOINT = KEYCLOAK.OIDC_OP_AUTHORIZATION_ENDPOINT
+OIDC_OP_TOKEN_ENDPOINT         = KEYCLOAK.OIDC_OP_TOKEN_ENDPOINT
+OIDC_OP_USER_ENDPOINT          = KEYCLOAK.OIDC_OP_USER_ENDPOINT
+OIDC_OP_JWKS_ENDPOINT          = KEYCLOAK.OIDC_OP_JWKS_ENDPOINT
+
+# ---- Tokens / security flags ------------------------------------------------
+# Verify TLS to Keycloak (False in dev is OK if your machine lacks the CA; True in prod),
+# request standard OIDC scopes, and declare the ID token signing algorithm used by Keycloak.
+OIDC_VERIFY_SSL  = KEYCLOAK.OIDC_VERIFY_SSL
+OIDC_RP_SCOPES   = KEYCLOAK.OIDC_RP_SCOPES         # "openid email profile"
+OIDC_RP_SIGN_ALGO = KEYCLOAK.OIDC_RP_SIGN_ALGO     # "RS256" for Keycloak
+
+# ---- RP-initiated logout ----------------------------------------------------
+# These enable POST /oidc/logout/ to clear Django session and call Keycloak’s logout
+# using the stored ID token, then redirect back to our app.
+OIDC_OP_LOGOUT_ENDPOINT  = KEYCLOAK.OIDC_OP_LOGOUT_ENDPOINT
+OIDC_STORE_ID_TOKEN      = KEYCLOAK.OIDC_STORE_ID_TOKEN
+OIDC_LOGOUT_REDIRECT_URL = KEYCLOAK.OIDC_LOGOUT_REDIRECT_URL
+
+# ---- Dev helper: force Keycloak login screen each time ----------------------
+# Adds extra params to the authorization request so Keycloak won’t silently SSO you.
+# Great for switching users during testing. Remove/empty in production.
+OIDC_AUTH_REQUEST_EXTRA_PARAMS = KEYCLOAK.OIDC_AUTH_REQUEST_EXTRA_PARAMS

endoreg_db/config/settings/keycloak.py

@@ -0,0 +1,177 @@
+# config/settings/keycloak.py
+
+from endoreg_db.config.env import env_bool, env_str
+
+# -----------------------------
+# CORE KEYCLOAK COORDINATES
+# -----------------------------
+
+# Base URL of your Keycloak server (scheme + host). Must be reachable by your Django app and the browser.
+KEYCLOAK_BASE_URL = env_str(
+    "KEYCLOAK_BASE_URL",
+    env_str("KEYCLOAK_SERVER_URL", "https://keycloak.endo-reg.net"),
+)
+
+# The Keycloak Realm that contains your users, roles, groups, and clients.
+KEYCLOAK_REALM = env_str("KEYCLOAK_REALM", "EndoregDb")
+
+# The specific Keycloak "Client" (OIDC client/app) your Django app uses.
+# It must exist in the realm, with Standard Flow enabled, proper redirect URIs, and Web Origins configured.
+OIDC_RP_CLIENT_ID = env_str(
+    "OIDC_RP_CLIENT_ID",
+    env_str("KEYCLOAK_CLIENT_ID", "endoregdb-api"),
+)
+
+# The client secret for the OIDC client above. This authenticates Django to Keycloak during token exchange.
+# ⚠️ Best practice: load this from environment variables, not hardcoded in git.
+# e.g. from endoreg_db.config.env import env_str; OIDC_RP_CLIENT_SECRET = env_str("OIDC_RP_CLIENT_SECRET", "")
+OIDC_RP_CLIENT_SECRET = env_str(
+    "OIDC_RP_CLIENT_SECRET",
+    env_str("KEYCLOAK_CLIENT_SECRET", ""),
+)
+
+# -----------------------------
+# DISCOVERY (OPTIONAL – NICE TO HAVE)
+# -----------------------------
+
+# OIDC discovery endpoint for your realm. Some libraries can auto-configure using this.
+# We also set explicit endpoints below so the login view doesn't rely solely on discovery.
+OIDC_OP_DISCOVERY_ENDPOINT = env_str(
+    "OIDC_OP_DISCOVERY_ENDPOINT",
+    f"{KEYCLOAK_BASE_URL}/realms/{KEYCLOAK_REALM}/.well-known/openid-configuration",
+)
+
+# -----------------------------
+# DJANGO LOGIN/LOGOUT ROUTES
+# -----------------------------
+
+# Built-in mozilla-django-oidc login entry point. We redirect browsers here when they hit /api/* without a session.
+LOGIN_URL = "/oidc/authenticate/"
+
+# Where Django should send the user after a successful login (if there is no ?next=... parameter).
+LOGIN_REDIRECT_URL = "/"
+
+# Where to send the user after a local Django logout (not the OIDC logout).
+LOGOUT_REDIRECT_URL = "/"
+
+# -----------------------------
+# DJANGO APP / MIDDLEWARE HOOKS
+# -----------------------------
+
+# Extra Django apps needed for OIDC login/logout views.
+EXTRA_INSTALLED_APPS = [
+    "mozilla_django_oidc",  # provides /oidc/authenticate/ and /oidc/callback/ routes
+]
+
+# Extra middleware to protect /api/* for browsers (redirect to OIDC if no session).
+# Your custom middleware should come AFTER AuthenticationMiddleware (already in base.py).
+EXTRA_MIDDLEWARE = [
+    "endoreg_db.authz.middleware.LoginRequiredForAPIsMiddleware",
+]
+
+# -----------------------------
+# DRF AUTHENTICATION CHAIN
+# ----------------------------
+
+# DRF authentication classes the API will try in order:
+# 1) SessionAuthentication – for browsers (Django session cookie)
+# 2) KeycloakJWTAuthentication – for API clients sending Authorization: Bearer <access_token>
+REST_FRAMEWORK_DEFAULT_AUTH = (
+    "rest_framework.authentication.SessionAuthentication",
+    "endoreg_db.authz.auth.KeycloakJWTAuthentication",
+)
+
+# -----------------------------
+# DJANGO AUTH BACKENDS
+# -----------------------------
+
+# The authentication backends Django calls when handling an OIDC login:
+# - KeycloakOIDCBackend handles the OIDC callback, verifies the ID token, creates/updates the Django user,
+#   and syncs roles into Django Groups.
+# - ModelBackend allows normal Django username/password auth (not used in OIDC flow, kept for admin/compat).
+AUTHENTICATION_BACKENDS = (
+    "endoreg_db.authz.backends.KeycloakOIDCBackend",
+    "django.contrib.auth.backends.ModelBackend",
+)
+
+# -----------------------------
+# TLS / CERT VERIFY (DEV vs PROD)
+# -----------------------------
+
+# Whether to verify TLS certificates when Django calls Keycloak (token/jwks endpoints).
+# DEV convenience: False to skip verification if your dev machine lacks the CA chain.
+# PROD: must be True and your system should trust the Keycloak certificate.
+OIDC_VERIFY_SSL = env_bool("OIDC_VERIFY_SSL", False)
+
+# -----------------------------
+# EXPLICIT PROVIDER ENDPOINTS
+# -----------------------------
+
+# Explicit OIDC endpoints under your realm. Setting these avoids relying solely on discovery at runtime.
+
+# Authorization endpoint (where we redirect the browser for the login page)
+OIDC_OP_AUTHORIZATION_ENDPOINT = env_str(
+    "OIDC_OP_AUTHORIZATION_ENDPOINT",
+    f"{KEYCLOAK_BASE_URL}/realms/{KEYCLOAK_REALM}/protocol/openid-connect/auth",
+)
+
+# Token endpoint (Django backend exchanges the auth code for tokens here)
+OIDC_OP_TOKEN_ENDPOINT = env_str(
+    "OIDC_OP_TOKEN_ENDPOINT",
+    f"{KEYCLOAK_BASE_URL}/realms/{KEYCLOAK_REALM}/protocol/openid-connect/token",
+)
+
+# UserInfo endpoint (optional user profile; some backends call this after login)
+OIDC_OP_USER_ENDPOINT = env_str(
+    "OIDC_OP_USER_ENDPOINT",
+    f"{KEYCLOAK_BASE_URL}/realms/{KEYCLOAK_REALM}/protocol/openid-connect/userinfo",
+)
+
+# JWKS endpoint (public keys used to verify signatures on ID/Access tokens)
+OIDC_OP_JWKS_ENDPOINT = env_str(
+    "OIDC_OP_JWKS_ENDPOINT",
+    f"{KEYCLOAK_BASE_URL}/realms/{KEYCLOAK_REALM}/protocol/openid-connect/certs",
+)
+
+# -----------------------------
+# TOKEN FORMAT / SCOPES
+# -----------------------------
+
+# Scopes requested at login. "openid" is required by OIDC; "email" and "profile" give you email/name claims.
+OIDC_RP_SCOPES = env_str("OIDC_RP_SCOPES", "openid email profile")
+
+# Algorithm used by Keycloak to sign ID tokens. Keycloak defaults to RS256.
+# This must match the provider, otherwise mozilla-django-oidc will reject the token.
+OIDC_RP_SIGN_ALGO = env_str("OIDC_RP_SIGN_ALGO", "RS256")
+
+# -----------------------------
+# LOGOUT (RP-INITIATED) SETTINGS
+# -----------------------------
+
+# Keycloak endpoint to terminate the SSO session server-side (RP-initiated logout).
+# mozilla-django-oidc will call this if OIDC_STORE_ID_TOKEN=True and you POST to /oidc/logout/.
+OIDC_OP_LOGOUT_ENDPOINT = env_str(
+    "OIDC_OP_LOGOUT_ENDPOINT",
+    f"{KEYCLOAK_BASE_URL}/realms/{KEYCLOAK_REALM}/protocol/openid-connect/logout",
+)
+
+# Store the ID token in the Django session so it can be sent to Keycloak during RP-initiated logout.
+OIDC_STORE_ID_TOKEN = env_bool("OIDC_STORE_ID_TOKEN", True)
+
+# Where to redirect the browser after OIDC logout completes.
+OIDC_LOGOUT_REDIRECT_URL = env_str("OIDC_LOGOUT_REDIRECT_URL", "/")
+
+# -----------------------------
+# DEV SWITCH: FORCE LOGIN PROMPT
+# -----------------------------
+
+# For development/testing: force Keycloak to show the login screen every time (disable silent SSO).
+# This is extremely useful when switching between test users frequently.
+# You can strengthen it further with {"prompt": "login", "max_age": "0"} to force re-auth on every request.
+OIDC_AUTH_REQUEST_EXTRA_PARAMS = {"prompt": "login"}
+
+# -----------------------------
+# (Optional) Handy URL:
+# Keycloak user account page for manual sign-out / session checks:
+# https://keycloak.endo-reg.net/realms/EndoregDb/account
+# -----------------------------

endoreg_db/config/settings/prod.py

@@ -0,0 +1,66 @@
+import os
+
+from .base import *  # noqa: F401,F403
+from .base import BASE_DIR
+from endoreg_db.config.env import env_bool, env_str
+
+DEBUG = env_bool("DJANGO_DEBUG", False)
+SECRET_KEY = env_str("DJANGO_SECRET_KEY")
+pytest_active = "PYTEST_CURRENT_TEST" in os.environ
+if not SECRET_KEY:
+    if pytest_active:
+        SECRET_KEY = "test-secret-key"
+    else:
+        raise ValueError("DJANGO_SECRET_KEY environment variable must be set in production")
+ALLOWED_HOSTS = [h for h in env_str("DJANGO_ALLOWED_HOSTS", "").split(",") if h]
+if not ALLOWED_HOSTS:
+    if pytest_active:
+        ALLOWED_HOSTS = ["*"]
+    else:
+        raise ValueError(
+            "DJANGO_ALLOWED_HOSTS must be set in production (comma-separated list of allowed hosts)"
+        )
+
+# Require explicit DB engine in production (no default to SQLite)
+DB_ENGINE = env_str("DB_ENGINE")
+if not DB_ENGINE:
+    if pytest_active:
+        DB_ENGINE = "django.db.backends.sqlite3"
+    else:
+        raise ValueError("DB_ENGINE must be set in production")
+
+# For non-sqlite engines, require DB_NAME; for sqlite, allow default to a file under BASE_DIR
+if DB_ENGINE.endswith("sqlite3"):
+    DB_NAME = env_str("DB_NAME", str(BASE_DIR / "prod_sim_db.sqlite3"))
+else:
+    DB_NAME = env_str("DB_NAME")
+    if not DB_NAME:
+        raise ValueError("DB_NAME must be set when using a non-sqlite database engine in production")
+
+# Optional credentials/connection params (only include if provided)
+DB_USER = env_str("DB_USER", "")
+DB_PASSWORD = env_str("DB_PASSWORD", "")
+DB_HOST = env_str("DB_HOST", "")
+DB_PORT = env_str("DB_PORT", "")
+
+_db_config = {
+    "ENGINE": DB_ENGINE,
+    "NAME": DB_NAME,
+}
+if not DB_ENGINE.endswith("sqlite3"):
+    if DB_USER:
+        _db_config["USER"] = DB_USER
+    if DB_PASSWORD:
+        _db_config["PASSWORD"] = DB_PASSWORD
+    if DB_HOST:
+        _db_config["HOST"] = DB_HOST
+    if DB_PORT:
+        _db_config["PORT"] = DB_PORT
+
+DATABASES = {"default": _db_config}
+
+STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'
+# Enforce HTTPS by default in production. Override via env only with strong justification.
+SECURE_SSL_REDIRECT = env_bool("SECURE_SSL_REDIRECT", True)
+SESSION_COOKIE_SECURE = env_bool("SESSION_COOKIE_SECURE", True)
+CSRF_COOKIE_SECURE = env_bool("CSRF_COOKIE_SECURE", True)

endoreg_db/config/settings/test.py

@@ -0,0 +1,72 @@
+from pathlib import Path
+
+from endoreg_db.config.env import env_bool, env_str
+
+from .base import *  # noqa: F401,F403
+from .base import BASE_DIR
+
+# Persistent test DB
+DEFAULT_TEST_DB_PATH = BASE_DIR / "data" / "tests" / "db" / "test_db.sqlite3"
+TEST_DB_FILE = Path(env_str("TEST_DB_FILE", str(DEFAULT_TEST_DB_PATH)))
+TEST_DB_FILE.parent.mkdir(parents=True, exist_ok=True)
+
+DEBUG = env_bool("DJANGO_DEBUG", True)
+SECRET_KEY = env_str("DJANGO_SECRET_KEY", "test-insecure-key")
+ALLOWED_HOSTS = env_str("DJANGO_ALLOWED_HOSTS", "*").split(",")
+
+DB_ENGINE = env_str("TEST_DB_ENGINE", "django.db.backends.sqlite3")
+DB_NAME = env_str("TEST_DB_NAME", str(TEST_DB_FILE))
+DB_USER = env_str("TEST_DB_USER", "")
+DB_PASSWORD = env_str("TEST_DB_PASSWORD", "")
+DB_HOST = env_str("TEST_DB_HOST", "")
+DB_PORT = env_str("TEST_DB_PORT", "")
+
+# Build DB config without redundant conditionals and avoid passing empty creds
+_db_config = {
+    "ENGINE": DB_ENGINE,
+    "NAME": DB_NAME,
+}
+if not DB_ENGINE.endswith("sqlite3"):
+    if DB_USER:
+        _db_config["USER"] = DB_USER
+    if DB_PASSWORD:
+        _db_config["PASSWORD"] = DB_PASSWORD
+    if DB_HOST:
+        _db_config["HOST"] = DB_HOST
+    if DB_PORT:
+        _db_config["PORT"] = DB_PORT
+
+DATABASES = {"default": _db_config}
+
+# Configure cache with explicit TIMEOUT for tests
+CACHES = {
+    "default": {
+        "BACKEND": "django.core.cache.backends.locmem.LocMemCache",
+        "LOCATION": "endoreg-test-cache",
+        "TIMEOUT": int(env_str("TEST_CACHE_TIMEOUT", str(60 * 30))),
+    }
+}
+
+# Faster password hashing
+PASSWORD_HASHERS = ["django.contrib.auth.hashers.MD5PasswordHasher"]
+
+# Toggle migrations via env
+if env_str("TEST_DISABLE_MIGRATIONS", "false").lower() == "true":
+
+    class DisableMigrations:
+        def __contains__(self, item):
+            return True
+
+        def __getitem__(self, item):
+            return None
+
+    #MIGRATION_MODULES = DisableMigrations()
+
+INSTALLED_APPS = [
+    "django.contrib.admin",
+    "django.contrib.auth",
+    "django.contrib.contenttypes",
+    "django.contrib.sessions",
+    "django.contrib.messages",
+    "endoreg_db",
+]