open-api-framework 0.8.0__tar.gz → 0.8.1__tar.gz

{open_api_framework-0.8.0 → open_api_framework-0.8.1}/CHANGELOG.rst

@@ -1,6 +1,15 @@
 Changelog
 =========
 
+0.8.1 (2024-09-26)
+------------------
+
+**Bugfixes/QOL**
+
+* Change SESSION_COOKIE_SAMESITE to "Lax" to fix OIDC (#72)
+* Remove url from SECRET_KEY help text (#76)
+* Change CSP headers to support API schema page
+
 0.8.0 (2024-08-22)
 ------------------
 

{open_api_framework-0.8.0/open_api_framework.egg-info → open_api_framework-0.8.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: open_api_framework
-Version: 0.8.0
+Version: 0.8.1
 Summary: A metapackage for registration components, that bundles the dependencies shared between these components and provides generic settings
 Author-email: Maykin Media <support@maykinmedia.nl>
 License: Copyright © Maykin 2024
@@ -41,7 +41,7 @@ Requires-Dist: django-redis>=5.4.0
 Requires-Dist: djangorestframework>=3.15.2
 Requires-Dist: djangorestframework-gis>=1.0
 Requires-Dist: django-filter>=24.2
-Requires-Dist: drf-spectacular>=0.27.2
+Requires-Dist: drf-spectacular[sidecar]>=0.27.2
 Requires-Dist: django-csp>=3.8
 Requires-Dist: djangorestframework-inclusions>=1.2.0
 Requires-Dist: commonground-api-common>=1.12.1
@@ -78,7 +78,7 @@ Requires-Dist: twine; extra == "release"
 Open API Framework
 ==================
 
-:Version: 0.8.0
+:Version: 0.8.1
 :Source: https://github.com/maykinmedia/open-api-framework
 :Keywords: metapackage, dependencies
 

{open_api_framework-0.8.0 → open_api_framework-0.8.1}/README.rst

@@ -1,7 +1,7 @@
 Open API Framework
 ==================
 
-:Version: 0.8.0
+:Version: 0.8.1
 :Source: https://github.com/maykinmedia/open-api-framework
 :Keywords: metapackage, dependencies
 

{open_api_framework-0.8.0 → open_api_framework-0.8.1}/open_api_framework/conf/base.py

@@ -39,10 +39,7 @@ SITE_ID = config(
 # SECURITY WARNING: keep the secret key used in production secret!
 SECRET_KEY = config(
     "SECRET_KEY",
-    help_text=(
-        "Secret key that's used for certain cryptographic utilities. "
-        "You should generate one via `miniwebtool <https://www.miniwebtool.com/django-secret-key-generator>`_"
-    ),
+    help_text="Secret key that's used for certain cryptographic utilities. ",
 )
 
 # NEVER run with DEBUG=True in production-like environments
@@ -213,6 +210,7 @@ INSTALLED_APPS = [
     "vng_api_common",
     "notifications_api_common",
     "drf_spectacular",
+    "drf_spectacular_sidecar",
     "rest_framework",
     "django_markup",
     "solo",
@@ -549,11 +547,12 @@ SESSION_COOKIE_SECURE = IS_HTTPS
 SESSION_COOKIE_HTTPONLY = True
 SESSION_COOKIE_SAMESITE = config(
     "SESSION_COOKIE_SAMESITE",
-    "Strict",
+    "Lax",
     help_text=(
         "The value of the SameSite flag on the session cookie. This flag prevents the "
         "cookie from being sent in cross-site requests thus preventing CSRF attacks and "
         "making some methods of stealing session cookie impossible."
+        "Currently interferes with OIDC. Keep the value set at Lax if used."
     ),
 )
 
@@ -955,9 +954,7 @@ LOG_OUTGOING_REQUESTS_MAX_AGE = config(
 # NOTE: make sure values are a tuple or list, and to quote special values like 'self'
 
 # ideally we'd use BASE_URI but it'd have to be lazy or cause issues
-CSP_DEFAULT_SRC = [
-    "'self'",
-] + config(
+CSP_DEFAULT_SRC = ["'self'"] + config(
     "CSP_EXTRA_DEFAULT_SRC",
     default=[],
     split=True,
@@ -998,12 +995,16 @@ CSP_FORM_ACTION = (
     + CORS_ALLOWED_ORIGINS
 )
 
-CSP_IMG_SRC = CSP_DEFAULT_SRC + config(
-    "CSP_EXTRA_IMG_SRC",
-    default=[],
-    split=True,
-    group="Content Security Policy",
-    help_text="Extra ``img-src`` sources for CSP other than ``CSP_DEFAULT_SRC``.",
+CSP_IMG_SRC = (
+    CSP_DEFAULT_SRC
+    + ["data:", "cdn.redoc.ly"]  # used by DRF spectacular
+    + config(
+        "CSP_EXTRA_IMG_SRC",
+        default=[],
+        split=True,
+        group="Content Security Policy",
+        help_text="Extra ``img-src`` sources for CSP other than ``CSP_DEFAULT_SRC``.",
+    )
 )
 
 # affects <object> and <embed> tags, block everything by default but allow deploy-time
@@ -1018,8 +1019,13 @@ CSP_OBJECT_SRC = config(
 
 # we must include this explicitly, otherwise the style-src only includes the nonce because
 # of CSP_INCLUDE_NONCE_IN
-CSP_STYLE_SRC = CSP_DEFAULT_SRC
-CSP_SCRIPT_SRC = CSP_DEFAULT_SRC
+CSP_STYLE_SRC = CSP_DEFAULT_SRC + [
+    "'unsafe-inline'",
+    "fonts.googleapis.com",
+]  # used by DRF spectacular
+CSP_SCRIPT_SRC = CSP_DEFAULT_SRC + ["'unsafe-inline'"]
+CSP_FONT_SRC = ("'self'", "fonts.gstatic.com")
+CSP_WORKER_SRC = ("'self'", "blob:")
 
 # firefox does not get the nonce from default-src, see
 # https://stackoverflow.com/a/63376012
@@ -1035,9 +1041,3 @@ CSP_FRAME_SRC = ["'self'"]
 # CSP_SANDBOX # too much
 
 CSP_UPGRADE_INSECURE_REQUESTS = False  # TODO enable on production?
-
-CSP_EXCLUDE_URL_PREFIXES = (
-    # ReDoc/Swagger pull in external sources, so don't enforce CSP on API endpoints/documentation.
-    "/api/",
-    "/admin/",
-)

{open_api_framework-0.8.0 → open_api_framework-0.8.1/open_api_framework.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: open_api_framework
-Version: 0.8.0
+Version: 0.8.1
 Summary: A metapackage for registration components, that bundles the dependencies shared between these components and provides generic settings
 Author-email: Maykin Media <support@maykinmedia.nl>
 License: Copyright © Maykin 2024
@@ -41,7 +41,7 @@ Requires-Dist: django-redis>=5.4.0
 Requires-Dist: djangorestframework>=3.15.2
 Requires-Dist: djangorestframework-gis>=1.0
 Requires-Dist: django-filter>=24.2
-Requires-Dist: drf-spectacular>=0.27.2
+Requires-Dist: drf-spectacular[sidecar]>=0.27.2
 Requires-Dist: django-csp>=3.8
 Requires-Dist: djangorestframework-inclusions>=1.2.0
 Requires-Dist: commonground-api-common>=1.12.1
@@ -78,7 +78,7 @@ Requires-Dist: twine; extra == "release"
 Open API Framework
 ==================
 
-:Version: 0.8.0
+:Version: 0.8.1
 :Source: https://github.com/maykinmedia/open-api-framework
 :Keywords: metapackage, dependencies
 

{open_api_framework-0.8.0 → open_api_framework-0.8.1}/open_api_framework.egg-info/requires.txt

@@ -9,7 +9,7 @@ django-redis>=5.4.0
 djangorestframework>=3.15.2
 djangorestframework-gis>=1.0
 django-filter>=24.2
-drf-spectacular>=0.27.2
+drf-spectacular[sidecar]>=0.27.2
 django-csp>=3.8
 djangorestframework-inclusions>=1.2.0
 commonground-api-common>=1.12.1

{open_api_framework-0.8.0 → open_api_framework-0.8.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "open_api_framework"
-version = "0.8.0"
+version = "0.8.1"
 description = "A metapackage for registration components, that bundles the dependencies shared between these components and provides generic settings"
 authors = [
     {name = "Maykin Media", email = "support@maykinmedia.nl"}
@@ -38,7 +38,7 @@ dependencies = [
     "djangorestframework>=3.15.2",
     "djangorestframework-gis>=1.0",
     "django-filter>=24.2",
-    "drf-spectacular>=0.27.2",
+    "drf-spectacular[sidecar]>=0.27.2",
     "django-csp>=3.8",
     "djangorestframework-inclusions>=1.2.0",
     "commonground-api-common>=1.12.1",
@@ -101,7 +101,7 @@ testpaths = ["tests"]
 DJANGO_SETTINGS_MODULE = "testapp.settings"
 
 [tool.bumpversion]
-current_version = "0.8.0"
+current_version = "0.8.1"
 files = [
     {filename = "pyproject.toml"},
     {filename = "README.rst"},