ntc-dev-kit 1.0.0__py3-none-any.whl

ntc/templates/drf_structure/templates/core/services/object_storage.py

@@ -0,0 +1,285 @@
+import mimetypes
+import re
+import uuid
+from pathlib import Path
+from urllib.parse import urlparse
+import posixpath
+
+import boto3
+from botocore.config import Config as BotoConfig
+from django.conf import settings
+
+
+IMAGE_MIME_TYPES = {"image/png", "image/jpeg", "image/webp", "image/gif"}
+AVATAR_MIME_TYPES = {"image/png", "image/jpeg", "image/webp"}
+VIDEO_MIME_TYPES = {"video/mp4", "video/quicktime", "video/webm"}
+
+
+MIME_TO_EXTENSION = {
+    "image/png": "png",
+    "image/jpeg": "jpg",
+    "image/webp": "webp",
+    "image/gif": "gif",
+    "video/mp4": "mp4",
+    "video/quicktime": "mov",
+    "video/webm": "webm",
+}
+
+
+def sanitize_filename(filename: str) -> str:
+    name = Path(filename).name.strip().lower()
+    stem = Path(name).stem
+    ext = Path(name).suffix.lower()
+    stem = re.sub(r"[^a-z0-9]+", "-", stem).strip("-")
+    if not stem:
+        stem = "file"
+    return f"{stem}{ext}"
+
+
+def extension_for_upload(uploaded_file) -> str:
+    content_type = (getattr(uploaded_file, "content_type", "") or "").lower()
+    if content_type in MIME_TO_EXTENSION:
+        return MIME_TO_EXTENSION[content_type]
+
+    suffix = Path(uploaded_file.name).suffix.lower().lstrip(".")
+    guessed = mimetypes.guess_type(uploaded_file.name)[0]
+    if guessed in MIME_TO_EXTENSION and suffix:
+        return suffix
+    return suffix or "bin"
+
+
+def validate_uploaded_file(uploaded_file, allowed_mime_types, max_size_bytes: int):
+    content_type = (getattr(uploaded_file, "content_type", "") or "").lower()
+    if content_type not in allowed_mime_types:
+        return f"Unsupported file type: {content_type or 'unknown'}"
+
+    if uploaded_file.size > max_size_bytes:
+        return f"File size exceeds {max_size_bytes // (1024 * 1024)} MB limit"
+
+    expected_ext = MIME_TO_EXTENSION.get(content_type)
+    actual_ext = Path(uploaded_file.name).suffix.lower().lstrip(".")
+    if expected_ext and actual_ext and expected_ext != actual_ext:
+        if not (expected_ext == "jpg" and actual_ext == "jpeg"):
+            return "File extension does not match MIME type"
+
+    return None
+
+
+def image_dimensions_or_none(uploaded_file):
+    try:
+        from PIL import Image
+
+        current_position = uploaded_file.tell()
+        uploaded_file.seek(0)
+        with Image.open(uploaded_file) as image:
+            width, height = image.size
+        uploaded_file.seek(current_position)
+        return width, height
+    except Exception:
+        return None, None
+
+
+def _build_s3_client(endpoint: str, access_key: str, secret_key: str, region: str):
+    """Return a boto3 S3 client configured for an S3-compatible endpoint.
+
+    Cloudflare R2 requires SigV4 and the ``auto`` region. ``virtual``
+    addressing style is not universally supported by R2 custom domains,
+    so we stick with the default path-style-friendly config.
+    """
+    return boto3.client(
+        's3',
+        endpoint_url=endpoint,
+        aws_access_key_id=access_key,
+        aws_secret_access_key=secret_key,
+        region_name=region or 'auto',
+        config=BotoConfig(
+            signature_version='s3v4',
+            retries={'max_attempts': 3},
+            s3={'addressing_style': 'path'},
+        ),
+    )
+
+
+class ObjectStorageService:
+    """High-level helper on top of Cloudflare R2 (S3-compatible).
+
+    All application code that needs to upload / delete / resolve media
+    should go through this service. Construction fails loudly when R2
+    credentials are missing — we intentionally do NOT fall back silently
+    so misconfiguration is obvious in dev.
+    """
+
+    def __init__(self):
+        endpoint = getattr(settings, 'R2_ENDPOINT', '')
+        access_key = getattr(settings, 'R2_ACCESS_KEY_ID', '')
+        secret_key = getattr(settings, 'R2_SECRET_ACCESS_KEY', '')
+        bucket = getattr(settings, 'R2_BUCKET', '')
+        public_base_url = getattr(settings, 'R2_PUBLIC_BASE_URL', '').strip()
+
+        if not (endpoint and access_key and secret_key and bucket):
+            raise RuntimeError(
+                'Cloudflare R2 is not configured. Set R2_ACCOUNT_ID (or '
+                'R2_ENDPOINT), R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, '
+                'and R2_BUCKET in the environment.'
+            )
+
+        if not public_base_url:
+            raise RuntimeError(
+                'R2_PUBLIC_BASE_URL is not configured. Set it to your bucket\'s '
+                'R2.dev subdomain or custom domain (e.g., '
+                'https://pub-<account-id>.r2.dev).'
+            )
+
+        self.client = _build_s3_client(
+            endpoint=endpoint,
+            access_key=access_key,
+            secret_key=secret_key,
+            region=getattr(settings, 'R2_REGION', 'auto'),
+        )
+        self.bucket = bucket
+        self.media_path = (getattr(settings, 'R2_MEDIA_PATH', '') or '').strip('/ ')
+        self.media_base_url = public_base_url.rstrip('/')
+
+    def _object_key(self, key: str) -> str:
+        return posix_safe_join(self.media_path, key)
+
+    def _public_url(self, key: str) -> str:
+        path = self._object_key(key)
+        return f"{self.media_base_url}/{path}"
+
+    def upload_file(self, uploaded_file, key: str):
+        content_type = getattr(uploaded_file, "content_type", None)
+        uploaded_file.seek(0)
+        body = uploaded_file.read()
+
+        extra_args = {}
+        if content_type:
+            extra_args['ContentType'] = content_type
+
+        self.client.put_object(
+            Bucket=self.bucket,
+            Key=self._object_key(key),
+            Body=body,
+            **extra_args,
+        )
+        return self._public_url(key), key
+
+    def upload_workspace_logo(self, workspace_id: str, uploaded_file):
+        ext = extension_for_upload(uploaded_file)
+        key = f"workspaces/{workspace_id}/logo.{ext}"
+        return self.upload_file(uploaded_file, key)
+
+    def upload_user_avatar(self, user_id: str, uploaded_file):
+        ext = extension_for_upload(uploaded_file)
+        key = f"users/{user_id}/avatar.{ext}"
+        return self.upload_file(uploaded_file, key)
+
+    def upload_workspace_media(self, workspace_id: str, uploaded_file):
+        safe_name = sanitize_filename(uploaded_file.name)
+        key = f"workspaces/{workspace_id}/media/{uuid.uuid4()}-{safe_name}"
+        return self.upload_file(uploaded_file, key)
+
+    def delete_by_key(self, key: str):
+        self.client.delete_object(
+            Bucket=self.bucket,
+            Key=self._object_key(key),
+        )
+
+    def upload_image_from_url(self, image_url: str, key: str) -> tuple:
+        """Download an image from URL and upload to R2 storage.
+
+        Args:
+            image_url: The URL to download the image from
+            key: The storage key (path) to save the image
+
+        Returns:
+            tuple: (public_url, storage_key) or (None, None) if failed
+        """
+        if not image_url:
+            return None, None
+
+        try:
+            import requests
+            from io import BytesIO
+
+            # Download the image
+            resp = requests.get(image_url, timeout=30)
+            resp.raise_for_status()
+
+            # Determine content type from response
+            content_type = resp.headers.get('content-type', 'image/jpeg')
+            if not content_type.startswith('image/'):
+                content_type = 'image/jpeg'
+
+            # Extract extension from content-type or URL
+            ext = 'jpg'
+            if 'png' in content_type:
+                ext = 'png'
+            elif 'gif' in content_type:
+                ext = 'gif'
+            elif 'webp' in content_type:
+                ext = 'webp'
+            elif 'jpg' in image_url.lower() or 'jpeg' in image_url.lower():
+                ext = 'jpg'
+            elif 'png' in image_url.lower():
+                ext = 'png'
+
+            # Ensure key has extension
+            if not key.endswith(('.jpg', '.jpeg', '.png', '.gif', '.webp')):
+                key = f"{key}.{ext}"
+
+            # Upload to R2
+            body = resp.content
+            self.client.put_object(
+                Bucket=self.bucket,
+                Key=self._object_key(key),
+                Body=body,
+                ContentType=content_type,
+            )
+            return self._public_url(key), key
+
+        except Exception as e:
+            import logging
+            logger = logging.getLogger(__name__)
+            logger.warning(f"Failed to download/upload image from {image_url}: {e}")
+            return None, None
+
+    def key_from_url(self, url: str):
+        """Extract the storage key from a public URL.
+
+        Handles three cases so both freshly-uploaded R2 URLs and legacy
+        rows still written against the MinIO base are resolvable:
+
+        1. URL starts with the configured R2 public base
+        2. URL is a bare S3/R2 endpoint URL (``…/<bucket>/<key>``)
+        3. URL is just a path, optionally prefixed by ``R2_MEDIA_PATH``
+        """
+        if not url:
+            return None
+
+        if self.media_base_url and url.startswith(f"{self.media_base_url}/"):
+            tail = url.replace(f"{self.media_base_url}/", "", 1)
+            return _strip_prefix(tail, self.media_path)
+
+        parsed = urlparse(url)
+        path = parsed.path.lstrip("/")
+        bucket_prefix = f"{self.bucket}/"
+        if path.startswith(bucket_prefix):
+            path = path[len(bucket_prefix):]
+
+        return _strip_prefix(path, self.media_path) or None
+
+
+def _strip_prefix(path: str, prefix: str) -> str:
+    prefix = (prefix or '').strip('/ ')
+    if prefix and path.startswith(f"{prefix}/"):
+        return path[len(prefix) + 1:]
+    return path
+
+
+def posix_safe_join(base: str, name: str) -> str:
+    base = (base or "").strip("/ ")
+    name = (name or "").replace("\\", "/").lstrip("/")
+    if base:
+        return f"{base}/{name}"
+    return name

ntc/templates/drf_structure/templates/django_project/asgi.py

@@ -0,0 +1,5 @@
+import os
+from django.core.asgi import get_asgi_application
+
+os.environ.setdefault('DJANGO_SETTINGS_MODULE', '{project_name}.settings.prod')
+application = get_asgi_application()

ntc/templates/drf_structure/templates/django_project/celery.py

@@ -0,0 +1,8 @@
+from __future__ import absolute_import, unicode_literals
+import os
+from celery import Celery
+
+os.environ.setdefault('DJANGO_SETTINGS_MODULE', '{project_name}.settings.dev')
+app = Celery('{project_name}')
+app.config_from_object('django.conf:settings', namespace='CELERY')
+app.autodiscover_tasks()

ntc/templates/drf_structure/templates/django_project/dev_settings.py

@@ -0,0 +1,2 @@
+from .base import *
+DEBUG = True

ntc/templates/drf_structure/templates/django_project/django_settings.txt

@@ -0,0 +1,322 @@
+from pathlib import Path
+import environ
+from datetime import timedelta
+import pytz
+import os
+import sentry_sdk
+from sentry_sdk.integrations.logging import LoggingIntegration
+from sentry_sdk.integrations.django import DjangoIntegration
+
+# Build paths inside the project like this: BASE_DIR / 'subdir'.
+BASE_DIR = Path(__file__).resolve().parent.parent.parent
+
+# Environment Variables
+env = environ.Env()
+environ.Env.read_env(env_file=BASE_DIR / '.env')
+
+DEBUG = env.bool('DEBUG', default=False)
+
+# SECURITY WARNING: keep the secret key used in production secret!
+SECRET_KEY = env('SECRET_KEY', default='your-secret-key')
+REFRESH_TOKEN_SECRET = env('SECRET_KEY', default='your-secret-key')
+BASE_URL = env('BASE_URL', default='http://127.0.0.1:8000')
+BACKEND_URL = env('BACKEND_URL', default='http://127.0.0.1:8000')
+FRONTEND_URL = env('FRONTEND_URL', default='http://127.0.0.1:3000')
+
+SENTRY_DSN = env('SENTRY_DSN', default='')
+
+# ── Cloudflare R2 (S3-compatible) ────────────────────────────────
+# All media is stored in Cloudflare R2. ``R2_PUBLIC_BASE_URL`` should
+# be either the bucket's R2.dev subdomain or a custom domain bound to
+# the bucket (this is what ends up in DB-persisted media URLs).
+R2_ACCOUNT_ID = env('R2_ACCOUNT_ID', default='').strip()
+R2_ACCESS_KEY_ID = env('R2_ACCESS_KEY_ID', default='').strip()
+R2_SECRET_ACCESS_KEY = env('R2_SECRET_ACCESS_KEY', default='').strip()
+R2_BUCKET = env('R2_BUCKET', default='miler-media').strip()
+R2_REGION = env('R2_REGION', default='auto').strip()
+R2_ENDPOINT = env(
+    'R2_ENDPOINT',
+    default=(
+        f'https://{R2_ACCOUNT_ID}.r2.cloudflarestorage.com'
+        if R2_ACCOUNT_ID else ''
+    ),
+).strip()
+R2_PUBLIC_BASE_URL = env('R2_PUBLIC_BASE_URL', default='').strip()
+if R2_PUBLIC_BASE_URL and not R2_PUBLIC_BASE_URL.startswith(('http://', 'https://')):
+    R2_PUBLIC_BASE_URL = f'https://{R2_PUBLIC_BASE_URL}'
+R2_PUBLIC_BASE_URL = R2_PUBLIC_BASE_URL.rstrip('/')
+R2_MEDIA_PATH = env('R2_MEDIA_PATH', default='').strip('/ ')
+
+# Canonical public base for media URLs. Consumers (e.g. serializers
+# validating that a URL lives on our own storage) should reference
+# this rather than any backend-specific setting.
+MEDIA_BASE_URL = R2_PUBLIC_BASE_URL
+
+DATABASE_ENGINE = env('DATABASE_ENGINE', default='django.db.backends.sqlite3')
+DATABASE_NAME = env('DATABASE_NAME', default='db.sqlite3')
+DATABASE_USER = env('DATABASE_USER', default='your-database-user')
+DATABASE_PASSWORD = env('DATABASE_PASSWORD', default='your-database-password')
+DATABASE_HOST = env('DATABASE_HOST', default='localhost')
+DATABASE_PORT = env('DATABASE_PORT', default='5432')
+
+EMAIL_HOST = env('EMAIL_HOST', default='localhost')
+EMAIL_HOST_USER = env('EMAIL_HOST_USER', default='your-email-user')
+EMAIL_HOST_PASSWORD = env('EMAIL_HOST_PASSWORD', default='your-email-password')
+EMAIL_PORT = env('EMAIL_PORT', default='5432')
+DEFAULT_FROM_EMAIL = env('DEFAULT_FROM_EMAIL', default='your-email@example.com')
+
+# ── Azure Communication Services (Email) ──────────────────────────
+# Production sends go through ACS when ``endpoint + access_key`` are
+# configured. In dev / tests, leave them blank to fall back to
+# ``console.EmailBackend``.
+AZURE_COMMUNICATION_ENDPOINT = env(
+    'AZURE_COMMUNICATION_ENDPOINT', default='',
+)
+AZURE_COMMUNICATION_ACCESS_KEY = env(
+    'AZURE_COMMUNICATION_ACCESS_KEY', default='',
+)
+AZURE_COMMUNICATION_EMAIL_SENDER_NO_REPLY = env(
+    'AZURE_COMMUNICATION_EMAIL_SENDER_NO_REPLY', default='',
+)
+AZURE_COMMUNICATION_EMAIL_SENDER_NOTIFICATION = env(
+    'AZURE_COMMUNICATION_EMAIL_SENDER_NOTIFICATION', default='',
+)
+AZURE_COMMUNICATION_EMAIL_SENDER_SUPPORT = env(
+    'AZURE_COMMUNICATION_EMAIL_SENDER_SUPPORT', default='',
+)
+AZURE_COMMUNICATION_EMAIL_SENDER_MARKETING = env(
+    'AZURE_COMMUNICATION_EMAIL_SENDER_MARKETING', default='',
+)
+# Legacy single-sender env kept as a fallback. Most events should pick
+# a purpose-specific sender via ``send_template_email(sender='...')``.
+AZURE_COMMUNICATION_EMAIL_SENDER = env(
+    'AZURE_COMMUNICATION_EMAIL_SENDER',
+    default=(
+        AZURE_COMMUNICATION_EMAIL_SENDER_NOTIFICATION
+        or AZURE_COMMUNICATION_EMAIL_SENDER_NO_REPLY
+        or AZURE_COMMUNICATION_EMAIL_SENDER_SUPPORT
+        or AZURE_COMMUNICATION_EMAIL_SENDER_MARKETING
+        or ''
+    ),
+)
+
+# Canonical map used by ``core.services.azure.email`` to resolve a
+# purpose keyword (``no_reply`` / ``notification`` / ``support`` /
+# ``marketing``) to a concrete MailFrom address. Each slot falls back
+# to the single-sender value so partial configs keep working.
+AZURE_COMMUNICATION_EMAIL_SENDERS = {
+    'no_reply': AZURE_COMMUNICATION_EMAIL_SENDER_NO_REPLY or AZURE_COMMUNICATION_EMAIL_SENDER,
+    'notification': AZURE_COMMUNICATION_EMAIL_SENDER_NOTIFICATION or AZURE_COMMUNICATION_EMAIL_SENDER,
+    'support': AZURE_COMMUNICATION_EMAIL_SENDER_SUPPORT or AZURE_COMMUNICATION_EMAIL_SENDER,
+    'marketing': AZURE_COMMUNICATION_EMAIL_SENDER_MARKETING or AZURE_COMMUNICATION_EMAIL_SENDER,
+}
+AZURE_COMMUNICATION_EMAIL_DEFAULT_SENDER_KEY = env(
+    'AZURE_COMMUNICATION_EMAIL_DEFAULT_SENDER_KEY', default='notification',
+)
+
+AZURE_COMMUNICATION_EMAIL_POLLING_INTERVAL_SECONDS = env.int(
+    'AZURE_COMMUNICATION_EMAIL_POLLING_INTERVAL_SECONDS', default=2,
+)
+AZURE_COMMUNICATION_EMAIL_TIMEOUT_SECONDS = env.int(
+    'AZURE_COMMUNICATION_EMAIL_TIMEOUT_SECONDS', default=60,
+)
+
+_ACS_HAS_CREDENTIALS = bool(
+    AZURE_COMMUNICATION_ENDPOINT and AZURE_COMMUNICATION_ACCESS_KEY
+)
+
+if _ACS_HAS_CREDENTIALS and AZURE_COMMUNICATION_EMAIL_SENDER:
+    EMAIL_BACKEND = (
+        'core.services.azure.email.backend.AzureCommunicationEmailBackend'
+    )
+    # Honour the ACS sender as the default From if none was set explicitly.
+    if DEFAULT_FROM_EMAIL == 'your-email@example.com':
+        DEFAULT_FROM_EMAIL = AZURE_COMMUNICATION_EMAIL_SENDER
+else:
+    EMAIL_BACKEND = env(
+        'EMAIL_BACKEND',
+        default='django.core.mail.backends.console.EmailBackend',
+    )
+
+JWT_ACCESS_TTL_MINUTES = env.int('JWT_ACCESS_TTL_MINUTES', default=15)
+
+REDIS_HOST = env('REDIS_HOST', default='localhost')
+REDIS_USER = env('REDIS_USER', default='your-redis-user')
+REDIS_PASSWORD = env('REDIS_PASSWORD', default='your-redis-password')
+REDIS_PORT = env('REDIS_PORT', default='6379')
+
+BEEM_API_KEY = env('BEEM_API_KEY', default='your-beem-api-key')
+SELCOM_MERCHANT_ID = env('SELCOM_MERCHANT_ID', default='your-selcom-merchant-id')
+CLICKPESA_CLIENT_ID = env('CLICKPESA_CLIENT_ID', default='your-clickpesa-client-id')
+POLAR_API_KEY = env('POLAR_API_KEY', default='your-polar-api-key')
+
+ALLOWED_HOSTS = ['*']
+
+CORS_ORIGIN_ALLOW_ALL = False
+CORS_ALLOW_CREDENTIALS = True
+CORS_ORIGIN_WHITELIST = (
+    'http://127.0.0.1:3000',
+    'http://127.0.0.1:8000',
+)
+
+
+SIMPLE_JWT = {
+    "TOKEN_OBTAIN_SERIALIZER": "nexent.auth_serializer.TokenObtainPairSerializer",
+    'ACCESS_TOKEN_LIFETIME': timedelta(minutes=JWT_ACCESS_TTL_MINUTES),
+    'REFRESH_TOKEN_LIFETIME': timedelta(days=14),
+    'ROTATE_REFRESH_TOKENS': False,
+    'BLACKLIST_AFTER_ROTATION': False,
+    'UPDATE_LAST_LOGIN': True,
+
+    'ALGORITHM': 'HS256',
+    'SIGNING_KEY': SECRET_KEY,
+    'VERIFYING_KEY': None,
+    'AUDIENCE': None,
+    'ISSUER': None,
+    'JWK_URL': None,
+    'LEEWAY': 0,
+
+    'AUTH_HEADER_TYPES': ('Bearer',),
+    'AUTH_HEADER_NAME': 'HTTP_AUTHORIZATION',
+    'USER_ID_FIELD': 'id',
+    'USER_ID_CLAIM': 'user_id',
+    'USER_AUTHENTICATION_RULE': 'rest_framework_simplejwt.authentication.default_user_authentication_rule',
+
+    'AUTH_TOKEN_CLASSES': ('rest_framework_simplejwt.tokens.AccessToken',),
+    'TOKEN_TYPE_CLAIM': 'token_type',
+    'TOKEN_USER_CLASS': 'rest_framework_simplejwt.models.TokenUser',
+
+    'JTI_CLAIM': 'jti',
+
+    'SLIDING_TOKEN_REFRESH_EXP_CLAIM': 'refresh_exp',
+    'SLIDING_TOKEN_LIFETIME': timedelta(minutes=5),
+    'SLIDING_TOKEN_REFRESH_LIFETIME': timedelta(days=1),
+
+    'AUTH_COOKIE': 'access_token',  # Cookie name. Enables cookies if value is set.
+    'AUTH_COOKIE_DOMAIN': None,     # A string like "example.com", or None for standard domain cookie.
+    'AUTH_COOKIE_SECURE': False,    # Whether the auth cookies should be secure (https:// only).
+    'AUTH_COOKIE_HTTP_ONLY' : True, # Http only cookie flag.It's not fetch by javascript.
+    'AUTH_COOKIE_PATH': '/',        # The path of the auth cookie.
+    'AUTH_COOKIE_SAMESITE': 'Lax',  # Whether to set the flag restricting cookie leaks on cross-site requests. This can be 'Lax', 'Strict', or None to disable the flag.
+}
+
+INSTALLED_APPS = [
+    "django.contrib.admin",
+    "django.contrib.auth",
+    "django.contrib.contenttypes",
+    "django.contrib.sessions",
+    "django.contrib.messages",
+    "django.contrib.staticfiles",
+    'rest_framework',
+    'rest_framework.authtoken',
+    'rest_framework_simplejwt',
+    'rest_framework_simplejwt.token_blacklist',
+    'django_celery_beat',
+    'corsheaders',
+    # Project apps
+    'apps.common',
+]
+
+MIDDLEWARE = [
+    'django.middleware.security.SecurityMiddleware',
+    'django.contrib.sessions.middleware.SessionMiddleware',
+    'django.middleware.common.CommonMiddleware',
+    'django.middleware.csrf.CsrfViewMiddleware',
+    'django.contrib.auth.middleware.AuthenticationMiddleware',
+    'django.contrib.messages.middleware.MessageMiddleware',
+    'corsheaders.middleware.CorsMiddleware',
+]
+
+ROOT_URLCONF = '{project_name}.urls'
+WSGI_APPLICATION = '{project_name}.wsgi.application'
+ASGI_APPLICATION = '{project_name}.asgi.application'
+
+TEMPLATES = [
+    {
+        "BACKEND": "django.template.backends.django.DjangoTemplates",
+        "DIRS": [],
+        "APP_DIRS": True,
+        "OPTIONS": {
+            "context_processors": [
+                "django.template.context_processors.debug",
+                "django.template.context_processors.request",
+                "django.contrib.auth.context_processors.auth",
+                "django.contrib.messages.context_processors.messages",
+            ],
+        },
+    },
+]
+
+DATABASES = {
+    'default': {
+        'ENGINE': DATABASE_ENGINE,
+        'NAME': DATABASE_NAME,
+        'USER': DATABASE_USER,
+        'PASSWORD': DATABASE_PASSWORD,
+        'HOST': DATABASE_HOST,
+        'PORT': DATABASE_PORT,
+    }
+}
+
+AUTH_PASSWORD_VALIDATORS = [
+    {
+        "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
+    },
+]
+
+REST_FRAMEWORK = {
+    'DEFAULT_AUTHENTICATION_CLASSES': [
+        'rest_framework_simplejwt.authentication.JWTAuthentication',
+    ],
+    'DEFAULT_RENDERER_CLASSES': [
+        'rest_framework.renderers.JSONRenderer',
+    ]
+}
+
+LANGUAGE_CODE = "en-us"
+
+TIME_ZONE = "UTC"
+
+USE_I18N = True
+
+USE_L10N = True
+
+USE_TZ = True
+
+STATIC_URL = '/static/'
+
+if not DEBUG:
+    SESSION_COOKIE_SECURE = True
+    CSRF_COOKIE_SECURE = True
+    SECURE_SSL_REDIRECT = True
+    SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
+
+# ── Sentry Configuration ───────────────────────────────────────────
+sentry_logging = LoggingIntegration(
+    level=None,  # Capture all log levels
+    event_level=None,  # Send all log levels as events
+)
+
+if SENTRY_DSN:
+    sentry_sdk.init(
+        dsn=SENTRY_DSN,
+        # Add data like request headers and IP for users,
+        # see https://docs.sentry.io/platforms/python/data-management/data-collected/ for more info
+        send_default_pii=True,
+        enable_logs=True,
+        integrations=[
+            sentry_logging,
+            DjangoIntegration(),
+        ],
+        traces_sample_rate=1.0,
+        profiles_sample_rate=1.0,
+    )