43 lines
1.9 KiB
Python
43 lines
1.9 KiB
Python
from pydantic_settings import BaseSettings
|
|
|
|
|
|
class Settings(BaseSettings):
|
|
SECRET_KEY: str = "change-me-in-production-use-a-long-random-string"
|
|
DATABASE_URL: str = "sqlite+aiosqlite:///./velxio.db"
|
|
DATA_DIR: str = "."
|
|
GOOGLE_CLIENT_ID: str = ""
|
|
GOOGLE_CLIENT_SECRET: str = ""
|
|
GOOGLE_REDIRECT_URI: str = "http://localhost:8001/api/auth/google/callback"
|
|
FRONTEND_URL: str = "http://localhost:5173"
|
|
# Set to true in production (HTTPS). Controls the Secure flag on the JWT cookie.
|
|
COOKIE_SECURE: bool = False
|
|
ACCESS_TOKEN_EXPIRE_MINUTES: int = 10080 # 7 days
|
|
|
|
# ── Odoo transactional-mail relay ──────────────────────────────────────
|
|
# The Velxio backend POSTs to `<ODOO_URL>/velxio/api/send-welcome` and
|
|
# `<ODOO_URL>/velxio/api/send-password-reset` on register / forgot-
|
|
# password. Calls are fire-and-forget — registration succeeds even when
|
|
# ODOO_URL is empty (no mail will be sent), so dev / CI doesn't need a
|
|
# working Odoo instance.
|
|
#
|
|
# ODOO_API_KEY must match the company-level X-Velxio-API-Key stored in
|
|
# `res.company.velxio_api_key` on the Odoo side (see
|
|
# odoo-addons/velxio_subscription/controllers/api.py).
|
|
ODOO_URL: str = ""
|
|
ODOO_API_KEY: str = ""
|
|
# How long to wait for Odoo before giving up the fire-and-forget call.
|
|
# Kept short so a stalled Odoo never holds an asyncio.create_task open
|
|
# for minutes.
|
|
ODOO_MAIL_TIMEOUT_S: float = 10.0
|
|
|
|
# Password-reset tuning. Tokens are random 32-byte URL-safe strings;
|
|
# only the SHA-256 hash is persisted so a database leak doesn't reveal
|
|
# usable reset codes.
|
|
PASSWORD_RESET_TOKEN_TTL_MINUTES: int = 60
|
|
PASSWORD_RESET_RATE_LIMIT_PER_HOUR: int = 3
|
|
|
|
model_config = {"env_file": ".env", "env_file_encoding": "utf-8"}
|
|
|
|
|
|
settings = Settings()
|