open-api-framework 0.7.0__tar.gz → 0.8.0__tar.gz

{open_api_framework-0.7.0 → open_api_framework-0.8.0}/CHANGELOG.rst

@@ -1,6 +1,33 @@
 Changelog
 =========
 
+0.8.0 (2024-08-22)
+------------------
+
+**New features**
+
+* Add Django CSP with configurable settings
+* Add SECURE_HSTS_SECONDS and CSRF_COOKIE_HTTPONLY settings
+
+.. warning::
+
+    SECURE_HSTS_SECONDS has been added with a default of 31536000 seconds, ensure that
+    before upgrading to this version of open-api-framework, your entire application is served
+    over HTTPS, otherwise this setting can break parts of your application (see https://docs.djangoproject.com/en/4.2/ref/middleware/#http-strict-transport-security)
+
+**Bugfixes/QOL**
+
+* Fix rendering for envvar defaults (previously quotes were escaped)
+* Move ``CACHE_DEFAULT``, ``CACHE_AXES``, ``EMAIL_HOST`` envvars to Required group (because they are required for Docker)
+* Add CI job to check if all envvars are either documented or excluded from documentation
+
+0.7.1 (2024-08-16)
+------------------
+
+**Bugfixes**
+
+* Add missing help_text for SESSION_COOKIE_SAMESITE and CSRF_COOKIE_SAMESITE envvars
+
 0.7.0 (2024-08-15)
 ------------------
 

{open_api_framework-0.7.0/open_api_framework.egg-info → open_api_framework-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: open_api_framework
-Version: 0.7.0
+Version: 0.8.0
 Summary: A metapackage for registration components, that bundles the dependencies shared between these components and provides generic settings
 Author-email: Maykin Media <support@maykinmedia.nl>
 License: Copyright © Maykin 2024
@@ -42,6 +42,7 @@ Requires-Dist: djangorestframework>=3.15.2
 Requires-Dist: djangorestframework-gis>=1.0
 Requires-Dist: django-filter>=24.2
 Requires-Dist: drf-spectacular>=0.27.2
+Requires-Dist: django-csp>=3.8
 Requires-Dist: djangorestframework-inclusions>=1.2.0
 Requires-Dist: commonground-api-common>=1.12.1
 Requires-Dist: mozilla-django-oidc-db>=0.19.0
@@ -77,7 +78,7 @@ Requires-Dist: twine; extra == "release"
 Open API Framework
 ==================
 
-:Version: 0.7.0
+:Version: 0.8.0
 :Source: https://github.com/maykinmedia/open-api-framework
 :Keywords: metapackage, dependencies
 

{open_api_framework-0.7.0 → open_api_framework-0.8.0}/README.rst

@@ -1,7 +1,7 @@
 Open API Framework
 ==================
 
-:Version: 0.7.0
+:Version: 0.8.0
 :Source: https://github.com/maykinmedia/open-api-framework
 :Keywords: metapackage, dependencies
 

{open_api_framework-0.7.0 → open_api_framework-0.8.0}/open_api_framework/conf/base.py

@@ -149,12 +149,17 @@ DEFAULT_AUTO_FIELD = "django.db.models.AutoField"
 CACHE_DEFAULT = config(
     "CACHE_DEFAULT",
     "localhost:6379/0",
-    help_text="redis cache address for the default cache",
+    help_text="redis cache address for the default cache (this **MUST** be set when using Docker)",
+    group="Required",
 )
 CACHE_AXES = config(
     "CACHE_AXES",
     "localhost:6379/0",
-    help_text="redis cache address for the brute force login protection cache",
+    help_text=(
+        "redis cache address for the brute force login protection cache "
+        "(this **MUST** be set when using Docker)"
+    ),
+    group="Required",
 )
 
 CACHES = {
@@ -203,6 +208,7 @@ INSTALLED_APPS = [
     # External applications.
     "axes",
     "django_filters",
+    "csp",
     "corsheaders",
     "vng_api_common",
     "notifications_api_common",
@@ -241,6 +247,7 @@ MIDDLEWARE = [
     "django.contrib.messages.middleware.MessageMiddleware",
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
     "axes.middleware.AxesMiddleware",
+    "csp.contrib.rate_limiting.RateLimitedCSPMiddleware",
 ]
 
 ROOT_URLCONF = f"{PROJECT_DIRNAME}.urls"
@@ -305,7 +312,8 @@ FILE_UPLOAD_PERMISSIONS = 0o644
 EMAIL_HOST = config(
     "EMAIL_HOST",
     default="localhost",
-    help_text="hostname for the outgoing e-mail server",
+    help_text="hostname for the outgoing e-mail server (this **MUST** be set when using Docker)",
+    group="Required",
 )
 EMAIL_PORT = config(
     "EMAIL_PORT",
@@ -539,10 +547,29 @@ LOGOUT_REDIRECT_URL = reverse_lazy("admin:index")
 #
 SESSION_COOKIE_SECURE = IS_HTTPS
 SESSION_COOKIE_HTTPONLY = True
-SESSION_COOKIE_SAMESITE = config("SESSION_COOKIE_SAMESITE", "Strict")
+SESSION_COOKIE_SAMESITE = config(
+    "SESSION_COOKIE_SAMESITE",
+    "Strict",
+    help_text=(
+        "The value of the SameSite flag on the session cookie. This flag prevents the "
+        "cookie from being sent in cross-site requests thus preventing CSRF attacks and "
+        "making some methods of stealing session cookie impossible."
+    ),
+)
 
 CSRF_COOKIE_SECURE = IS_HTTPS
-CSRF_COOKIE_SAMESITE = config("CSRF_COOKIE_SAMESITE", "Strict")
+CSRF_COOKIE_HTTPONLY = True
+CSRF_COOKIE_SAMESITE = config(
+    "CSRF_COOKIE_SAMESITE",
+    "Strict",
+    help_text=(
+        "The value of the SameSite flag on the CSRF cookie. This flag prevents the cookie "
+        "from being sent in cross-site requests."
+    ),
+)
+
+if IS_HTTPS:
+    SECURE_HSTS_SECONDS = 31536000
 
 X_FRAME_OPTIONS = "DENY"
 
@@ -591,7 +618,7 @@ if subpath:
     SUBPATH = subpath
 
 if "GIT_SHA" in os.environ:
-    GIT_SHA = config("GIT_SHA", "")
+    GIT_SHA = config("GIT_SHA", "", add_to_docs=False)
 # in docker (build) context, there is no .git directory
 elif (Path(BASE_DIR) / ".git").exists():
     try:
@@ -822,7 +849,7 @@ MOZILLA_DJANGO_OIDC_DB_CACHE_TIMEOUT = 5 * 60
 ELASTIC_APM_SERVER_URL = config(
     "ELASTIC_APM_SERVER_URL",
     None,
-    "URL where Elastic APM is hosted",
+    help_text="URL where Elastic APM is hosted",
     group="Elastic APM",
 )
 ELASTIC_APM = {
@@ -840,7 +867,7 @@ ELASTIC_APM = {
     "SECRET_TOKEN": config(
         "ELASTIC_APM_SECRET_TOKEN",
         "default",
-        "Token used to communicate with Elastic APM",
+        help_text="Token used to communicate with Elastic APM",
         group="Elastic APM",
     ),
     "SERVER_URL": ELASTIC_APM_SERVER_URL,
@@ -917,3 +944,100 @@ LOG_OUTGOING_REQUESTS_MAX_AGE = config(
     default=7,
     help_text="The amount of time after which request logs should be deleted from the database",
 )  # number of days
+
+
+#
+# Django CSP settings
+#
+# explanation of directives: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+# and how to specify them: https://django-csp.readthedocs.io/en/latest/configuration.html
+#
+# NOTE: make sure values are a tuple or list, and to quote special values like 'self'
+
+# ideally we'd use BASE_URI but it'd have to be lazy or cause issues
+CSP_DEFAULT_SRC = [
+    "'self'",
+] + config(
+    "CSP_EXTRA_DEFAULT_SRC",
+    default=[],
+    split=True,
+    group="Content Security Policy",
+    help_text="Extra default source URLs for CSP other than ``self``. "
+    "Used for ``img-src``, ``style-src`` and ``script-src``",
+)
+
+
+CSP_REPORT_URI = config(
+    "CSP_REPORT_URI",
+    None,
+    group="Content Security Policy",
+    help_text="URI of the``report-uri`` directive.",
+)
+CSP_REPORT_PERCENTAGE = config(
+    "CSP_REPORT_PERCENTAGE",
+    0,
+    group="Content Security Policy",
+    help_text="Percentage of requests that get the ``report-uri`` directive.",
+)  # float between 0 and 1
+
+CSP_FORM_ACTION = (
+    config(
+        "CSP_FORM_ACTION",
+        default=["\"'self'\""]
+        + config(
+            "CSP_EXTRA_FORM_ACTION",
+            default=[],
+            split=True,
+            group="Content Security Policy",
+            help_text="Add additional ``form-action`` source to the default ",
+        ),
+        split=True,
+        group="Content Security Policy",
+        help_text="Override the default ``form-action`` source",
+    )
+    + CORS_ALLOWED_ORIGINS
+)
+
+CSP_IMG_SRC = CSP_DEFAULT_SRC + config(
+    "CSP_EXTRA_IMG_SRC",
+    default=[],
+    split=True,
+    group="Content Security Policy",
+    help_text="Extra ``img-src`` sources for CSP other than ``CSP_DEFAULT_SRC``.",
+)
+
+# affects <object> and <embed> tags, block everything by default but allow deploy-time
+# overrides.
+CSP_OBJECT_SRC = config(
+    "CSP_OBJECT_SRC",
+    default=["\"'none'\""],
+    split=True,
+    group="Content Security Policy",
+    help_text="``object-src`` urls",
+)
+
+# we must include this explicitly, otherwise the style-src only includes the nonce because
+# of CSP_INCLUDE_NONCE_IN
+CSP_STYLE_SRC = CSP_DEFAULT_SRC
+CSP_SCRIPT_SRC = CSP_DEFAULT_SRC
+
+# firefox does not get the nonce from default-src, see
+# https://stackoverflow.com/a/63376012
+CSP_INCLUDE_NONCE_IN = ["style-src", "script-src"]
+
+# directives that don't fallback to default-src
+CSP_BASE_URI = ["'self'"]
+
+# Frame directives do not fall back to default-src
+CSP_FRAME_ANCESTORS = ["'none'"]  # equivalent to X-Frame-Options: deny
+CSP_FRAME_SRC = ["'self'"]
+# CSP_NAVIGATE_TO = ["'self'"]  # this will break all outgoing links etc  # too much & tricky, see note on MDN
+# CSP_SANDBOX # too much
+
+CSP_UPGRADE_INSECURE_REQUESTS = False  # TODO enable on production?
+
+CSP_EXCLUDE_URL_PREFIXES = (
+    # ReDoc/Swagger pull in external sources, so don't enforce CSP on API endpoints/documentation.
+    "/api/",
+    "/admin/",
+)

{open_api_framework-0.7.0 → open_api_framework-0.8.0}/open_api_framework/templates/open_api_framework/env_config.rst

@@ -13,7 +13,7 @@ Available environment variables
 {{group_name}}
 {{group_name|repeat_char:"-"}}
 
-{% for var in vars %}* ``{{var.name}}``: {% if var.help_text %}{{var.help_text|safe|ensure_endswith:"."}}{% endif %}{% if var.auto_display_default and not var.default|is_undefined %} Defaults to: ``{{var.default|to_str}}``.{% endif %}
+{% for var in vars %}* ``{{var.name}}``: {% if var.help_text %}{{var.help_text|safe|ensure_endswith:"."}}{% endif %}{% if var.auto_display_default and not var.default|is_undefined %} Defaults to: ``{{var.default|to_str|safe}}``.{% endif %}
 {% endfor %}
 {% endfor %}
 

{open_api_framework-0.7.0 → open_api_framework-0.8.0/open_api_framework.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: open_api_framework
-Version: 0.7.0
+Version: 0.8.0
 Summary: A metapackage for registration components, that bundles the dependencies shared between these components and provides generic settings
 Author-email: Maykin Media <support@maykinmedia.nl>
 License: Copyright © Maykin 2024
@@ -42,6 +42,7 @@ Requires-Dist: djangorestframework>=3.15.2
 Requires-Dist: djangorestframework-gis>=1.0
 Requires-Dist: django-filter>=24.2
 Requires-Dist: drf-spectacular>=0.27.2
+Requires-Dist: django-csp>=3.8
 Requires-Dist: djangorestframework-inclusions>=1.2.0
 Requires-Dist: commonground-api-common>=1.12.1
 Requires-Dist: mozilla-django-oidc-db>=0.19.0
@@ -77,7 +78,7 @@ Requires-Dist: twine; extra == "release"
 Open API Framework
 ==================
 
-:Version: 0.7.0
+:Version: 0.8.0
 :Source: https://github.com/maykinmedia/open-api-framework
 :Keywords: metapackage, dependencies
 

{open_api_framework-0.7.0 → open_api_framework-0.8.0}/open_api_framework.egg-info/requires.txt

@@ -10,6 +10,7 @@ djangorestframework>=3.15.2
 djangorestframework-gis>=1.0
 django-filter>=24.2
 drf-spectacular>=0.27.2
+django-csp>=3.8
 djangorestframework-inclusions>=1.2.0
 commonground-api-common>=1.12.1
 mozilla-django-oidc-db>=0.19.0

{open_api_framework-0.7.0 → open_api_framework-0.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "open_api_framework"
-version = "0.7.0"
+version = "0.8.0"
 description = "A metapackage for registration components, that bundles the dependencies shared between these components and provides generic settings"
 authors = [
     {name = "Maykin Media", email = "support@maykinmedia.nl"}
@@ -39,6 +39,7 @@ dependencies = [
     "djangorestframework-gis>=1.0",
     "django-filter>=24.2",
     "drf-spectacular>=0.27.2",
+    "django-csp>=3.8",
     "djangorestframework-inclusions>=1.2.0",
     "commonground-api-common>=1.12.1",
     "mozilla-django-oidc-db>=0.19.0",
@@ -100,7 +101,7 @@ testpaths = ["tests"]
 DJANGO_SETTINGS_MODULE = "testapp.settings"
 
 [tool.bumpversion]
-current_version = "0.7.0"
+current_version = "0.8.0"
 files = [
     {filename = "pyproject.toml"},
     {filename = "README.rst"},