open-api-framework 0.7.1__tar.gz → 0.8.1__tar.gz

{open_api_framework-0.7.1 → open_api_framework-0.8.1}/CHANGELOG.rst

@@ -1,6 +1,35 @@
 Changelog
 =========
 
+0.8.1 (2024-09-26)
+------------------
+
+**Bugfixes/QOL**
+
+* Change SESSION_COOKIE_SAMESITE to "Lax" to fix OIDC (#72)
+* Remove url from SECRET_KEY help text (#76)
+* Change CSP headers to support API schema page
+
+0.8.0 (2024-08-22)
+------------------
+
+**New features**
+
+* Add Django CSP with configurable settings
+* Add SECURE_HSTS_SECONDS and CSRF_COOKIE_HTTPONLY settings
+
+.. warning::
+
+    SECURE_HSTS_SECONDS has been added with a default of 31536000 seconds, ensure that
+    before upgrading to this version of open-api-framework, your entire application is served
+    over HTTPS, otherwise this setting can break parts of your application (see https://docs.djangoproject.com/en/4.2/ref/middleware/#http-strict-transport-security)
+
+**Bugfixes/QOL**
+
+* Fix rendering for envvar defaults (previously quotes were escaped)
+* Move ``CACHE_DEFAULT``, ``CACHE_AXES``, ``EMAIL_HOST`` envvars to Required group (because they are required for Docker)
+* Add CI job to check if all envvars are either documented or excluded from documentation
+
 0.7.1 (2024-08-16)
 ------------------
 

{open_api_framework-0.7.1/open_api_framework.egg-info → open_api_framework-0.8.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: open_api_framework
-Version: 0.7.1
+Version: 0.8.1
 Summary: A metapackage for registration components, that bundles the dependencies shared between these components and provides generic settings
 Author-email: Maykin Media <support@maykinmedia.nl>
 License: Copyright © Maykin 2024
@@ -41,7 +41,8 @@ Requires-Dist: django-redis>=5.4.0
 Requires-Dist: djangorestframework>=3.15.2
 Requires-Dist: djangorestframework-gis>=1.0
 Requires-Dist: django-filter>=24.2
-Requires-Dist: drf-spectacular>=0.27.2
+Requires-Dist: drf-spectacular[sidecar]>=0.27.2
+Requires-Dist: django-csp>=3.8
 Requires-Dist: djangorestframework-inclusions>=1.2.0
 Requires-Dist: commonground-api-common>=1.12.1
 Requires-Dist: mozilla-django-oidc-db>=0.19.0
@@ -77,7 +78,7 @@ Requires-Dist: twine; extra == "release"
 Open API Framework
 ==================
 
-:Version: 0.7.1
+:Version: 0.8.1
 :Source: https://github.com/maykinmedia/open-api-framework
 :Keywords: metapackage, dependencies
 

{open_api_framework-0.7.1 → open_api_framework-0.8.1}/README.rst

@@ -1,7 +1,7 @@
 Open API Framework
 ==================
 
-:Version: 0.7.1
+:Version: 0.8.1
 :Source: https://github.com/maykinmedia/open-api-framework
 :Keywords: metapackage, dependencies
 

{open_api_framework-0.7.1 → open_api_framework-0.8.1}/open_api_framework/conf/base.py

@@ -39,10 +39,7 @@ SITE_ID = config(
 # SECURITY WARNING: keep the secret key used in production secret!
 SECRET_KEY = config(
     "SECRET_KEY",
-    help_text=(
-        "Secret key that's used for certain cryptographic utilities. "
-        "You should generate one via `miniwebtool <https://www.miniwebtool.com/django-secret-key-generator>`_"
-    ),
+    help_text="Secret key that's used for certain cryptographic utilities. ",
 )
 
 # NEVER run with DEBUG=True in production-like environments
@@ -149,12 +146,17 @@ DEFAULT_AUTO_FIELD = "django.db.models.AutoField"
 CACHE_DEFAULT = config(
     "CACHE_DEFAULT",
     "localhost:6379/0",
-    help_text="redis cache address for the default cache",
+    help_text="redis cache address for the default cache (this **MUST** be set when using Docker)",
+    group="Required",
 )
 CACHE_AXES = config(
     "CACHE_AXES",
     "localhost:6379/0",
-    help_text="redis cache address for the brute force login protection cache",
+    help_text=(
+        "redis cache address for the brute force login protection cache "
+        "(this **MUST** be set when using Docker)"
+    ),
+    group="Required",
 )
 
 CACHES = {
@@ -203,10 +205,12 @@ INSTALLED_APPS = [
     # External applications.
     "axes",
     "django_filters",
+    "csp",
     "corsheaders",
     "vng_api_common",
     "notifications_api_common",
     "drf_spectacular",
+    "drf_spectacular_sidecar",
     "rest_framework",
     "django_markup",
     "solo",
@@ -241,6 +245,7 @@ MIDDLEWARE = [
     "django.contrib.messages.middleware.MessageMiddleware",
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
     "axes.middleware.AxesMiddleware",
+    "csp.contrib.rate_limiting.RateLimitedCSPMiddleware",
 ]
 
 ROOT_URLCONF = f"{PROJECT_DIRNAME}.urls"
@@ -305,7 +310,8 @@ FILE_UPLOAD_PERMISSIONS = 0o644
 EMAIL_HOST = config(
     "EMAIL_HOST",
     default="localhost",
-    help_text="hostname for the outgoing e-mail server",
+    help_text="hostname for the outgoing e-mail server (this **MUST** be set when using Docker)",
+    group="Required",
 )
 EMAIL_PORT = config(
     "EMAIL_PORT",
@@ -541,15 +547,17 @@ SESSION_COOKIE_SECURE = IS_HTTPS
 SESSION_COOKIE_HTTPONLY = True
 SESSION_COOKIE_SAMESITE = config(
     "SESSION_COOKIE_SAMESITE",
-    "Strict",
+    "Lax",
     help_text=(
         "The value of the SameSite flag on the session cookie. This flag prevents the "
         "cookie from being sent in cross-site requests thus preventing CSRF attacks and "
         "making some methods of stealing session cookie impossible."
+        "Currently interferes with OIDC. Keep the value set at Lax if used."
     ),
 )
 
 CSRF_COOKIE_SECURE = IS_HTTPS
+CSRF_COOKIE_HTTPONLY = True
 CSRF_COOKIE_SAMESITE = config(
     "CSRF_COOKIE_SAMESITE",
     "Strict",
@@ -559,6 +567,9 @@ CSRF_COOKIE_SAMESITE = config(
     ),
 )
 
+if IS_HTTPS:
+    SECURE_HSTS_SECONDS = 31536000
+
 X_FRAME_OPTIONS = "DENY"
 
 #
@@ -606,7 +617,7 @@ if subpath:
     SUBPATH = subpath
 
 if "GIT_SHA" in os.environ:
-    GIT_SHA = config("GIT_SHA", "")
+    GIT_SHA = config("GIT_SHA", "", add_to_docs=False)
 # in docker (build) context, there is no .git directory
 elif (Path(BASE_DIR) / ".git").exists():
     try:
@@ -837,7 +848,7 @@ MOZILLA_DJANGO_OIDC_DB_CACHE_TIMEOUT = 5 * 60
 ELASTIC_APM_SERVER_URL = config(
     "ELASTIC_APM_SERVER_URL",
     None,
-    "URL where Elastic APM is hosted",
+    help_text="URL where Elastic APM is hosted",
     group="Elastic APM",
 )
 ELASTIC_APM = {
@@ -855,7 +866,7 @@ ELASTIC_APM = {
     "SECRET_TOKEN": config(
         "ELASTIC_APM_SECRET_TOKEN",
         "default",
-        "Token used to communicate with Elastic APM",
+        help_text="Token used to communicate with Elastic APM",
         group="Elastic APM",
     ),
     "SERVER_URL": ELASTIC_APM_SERVER_URL,
@@ -932,3 +943,101 @@ LOG_OUTGOING_REQUESTS_MAX_AGE = config(
     default=7,
     help_text="The amount of time after which request logs should be deleted from the database",
 )  # number of days
+
+
+#
+# Django CSP settings
+#
+# explanation of directives: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+# and how to specify them: https://django-csp.readthedocs.io/en/latest/configuration.html
+#
+# NOTE: make sure values are a tuple or list, and to quote special values like 'self'
+
+# ideally we'd use BASE_URI but it'd have to be lazy or cause issues
+CSP_DEFAULT_SRC = ["'self'"] + config(
+    "CSP_EXTRA_DEFAULT_SRC",
+    default=[],
+    split=True,
+    group="Content Security Policy",
+    help_text="Extra default source URLs for CSP other than ``self``. "
+    "Used for ``img-src``, ``style-src`` and ``script-src``",
+)
+
+
+CSP_REPORT_URI = config(
+    "CSP_REPORT_URI",
+    None,
+    group="Content Security Policy",
+    help_text="URI of the``report-uri`` directive.",
+)
+CSP_REPORT_PERCENTAGE = config(
+    "CSP_REPORT_PERCENTAGE",
+    0,
+    group="Content Security Policy",
+    help_text="Percentage of requests that get the ``report-uri`` directive.",
+)  # float between 0 and 1
+
+CSP_FORM_ACTION = (
+    config(
+        "CSP_FORM_ACTION",
+        default=["\"'self'\""]
+        + config(
+            "CSP_EXTRA_FORM_ACTION",
+            default=[],
+            split=True,
+            group="Content Security Policy",
+            help_text="Add additional ``form-action`` source to the default ",
+        ),
+        split=True,
+        group="Content Security Policy",
+        help_text="Override the default ``form-action`` source",
+    )
+    + CORS_ALLOWED_ORIGINS
+)
+
+CSP_IMG_SRC = (
+    CSP_DEFAULT_SRC
+    + ["data:", "cdn.redoc.ly"]  # used by DRF spectacular
+    + config(
+        "CSP_EXTRA_IMG_SRC",
+        default=[],
+        split=True,
+        group="Content Security Policy",
+        help_text="Extra ``img-src`` sources for CSP other than ``CSP_DEFAULT_SRC``.",
+    )
+)
+
+# affects <object> and <embed> tags, block everything by default but allow deploy-time
+# overrides.
+CSP_OBJECT_SRC = config(
+    "CSP_OBJECT_SRC",
+    default=["\"'none'\""],
+    split=True,
+    group="Content Security Policy",
+    help_text="``object-src`` urls",
+)
+
+# we must include this explicitly, otherwise the style-src only includes the nonce because
+# of CSP_INCLUDE_NONCE_IN
+CSP_STYLE_SRC = CSP_DEFAULT_SRC + [
+    "'unsafe-inline'",
+    "fonts.googleapis.com",
+]  # used by DRF spectacular
+CSP_SCRIPT_SRC = CSP_DEFAULT_SRC + ["'unsafe-inline'"]
+CSP_FONT_SRC = ("'self'", "fonts.gstatic.com")
+CSP_WORKER_SRC = ("'self'", "blob:")
+
+# firefox does not get the nonce from default-src, see
+# https://stackoverflow.com/a/63376012
+CSP_INCLUDE_NONCE_IN = ["style-src", "script-src"]
+
+# directives that don't fallback to default-src
+CSP_BASE_URI = ["'self'"]
+
+# Frame directives do not fall back to default-src
+CSP_FRAME_ANCESTORS = ["'none'"]  # equivalent to X-Frame-Options: deny
+CSP_FRAME_SRC = ["'self'"]
+# CSP_NAVIGATE_TO = ["'self'"]  # this will break all outgoing links etc  # too much & tricky, see note on MDN
+# CSP_SANDBOX # too much
+
+CSP_UPGRADE_INSECURE_REQUESTS = False  # TODO enable on production?

{open_api_framework-0.7.1 → open_api_framework-0.8.1}/open_api_framework/templates/open_api_framework/env_config.rst

@@ -13,7 +13,7 @@ Available environment variables
 {{group_name}}
 {{group_name|repeat_char:"-"}}
 
-{% for var in vars %}* ``{{var.name}}``: {% if var.help_text %}{{var.help_text|safe|ensure_endswith:"."}}{% endif %}{% if var.auto_display_default and not var.default|is_undefined %} Defaults to: ``{{var.default|to_str}}``.{% endif %}
+{% for var in vars %}* ``{{var.name}}``: {% if var.help_text %}{{var.help_text|safe|ensure_endswith:"."}}{% endif %}{% if var.auto_display_default and not var.default|is_undefined %} Defaults to: ``{{var.default|to_str|safe}}``.{% endif %}
 {% endfor %}
 {% endfor %}
 

{open_api_framework-0.7.1 → open_api_framework-0.8.1/open_api_framework.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: open_api_framework
-Version: 0.7.1
+Version: 0.8.1
 Summary: A metapackage for registration components, that bundles the dependencies shared between these components and provides generic settings
 Author-email: Maykin Media <support@maykinmedia.nl>
 License: Copyright © Maykin 2024
@@ -41,7 +41,8 @@ Requires-Dist: django-redis>=5.4.0
 Requires-Dist: djangorestframework>=3.15.2
 Requires-Dist: djangorestframework-gis>=1.0
 Requires-Dist: django-filter>=24.2
-Requires-Dist: drf-spectacular>=0.27.2
+Requires-Dist: drf-spectacular[sidecar]>=0.27.2
+Requires-Dist: django-csp>=3.8
 Requires-Dist: djangorestframework-inclusions>=1.2.0
 Requires-Dist: commonground-api-common>=1.12.1
 Requires-Dist: mozilla-django-oidc-db>=0.19.0
@@ -77,7 +78,7 @@ Requires-Dist: twine; extra == "release"
 Open API Framework
 ==================
 
-:Version: 0.7.1
+:Version: 0.8.1
 :Source: https://github.com/maykinmedia/open-api-framework
 :Keywords: metapackage, dependencies
 

{open_api_framework-0.7.1 → open_api_framework-0.8.1}/open_api_framework.egg-info/requires.txt

@@ -9,7 +9,8 @@ django-redis>=5.4.0
 djangorestframework>=3.15.2
 djangorestframework-gis>=1.0
 django-filter>=24.2
-drf-spectacular>=0.27.2
+drf-spectacular[sidecar]>=0.27.2
+django-csp>=3.8
 djangorestframework-inclusions>=1.2.0
 commonground-api-common>=1.12.1
 mozilla-django-oidc-db>=0.19.0

{open_api_framework-0.7.1 → open_api_framework-0.8.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "open_api_framework"
-version = "0.7.1"
+version = "0.8.1"
 description = "A metapackage for registration components, that bundles the dependencies shared between these components and provides generic settings"
 authors = [
     {name = "Maykin Media", email = "support@maykinmedia.nl"}
@@ -38,7 +38,8 @@ dependencies = [
     "djangorestframework>=3.15.2",
     "djangorestframework-gis>=1.0",
     "django-filter>=24.2",
-    "drf-spectacular>=0.27.2",
+    "drf-spectacular[sidecar]>=0.27.2",
+    "django-csp>=3.8",
     "djangorestframework-inclusions>=1.2.0",
     "commonground-api-common>=1.12.1",
     "mozilla-django-oidc-db>=0.19.0",
@@ -100,7 +101,7 @@ testpaths = ["tests"]
 DJANGO_SETTINGS_MODULE = "testapp.settings"
 
 [tool.bumpversion]
-current_version = "0.7.1"
+current_version = "0.8.1"
 files = [
     {filename = "pyproject.toml"},
     {filename = "README.rst"},