sync: migrate secure-online-shop to Gitea (2026-08-10)

app/core/config.py

@@ -0,0 +1,79 @@
+from __future__ import annotations
+
+from functools import lru_cache
+from pathlib import Path
+
+from pydantic import Field, field_validator
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+PROJECT_ROOT = Path(__file__).resolve().parents[2]
+
+
+class Settings(BaseSettings):
+    app_name: str = "Secure E-commerce API"
+    api_v1_prefix: str = "/api/v1"
+    database_url: str = "sqlite:///./ecommerce.db"
+    jwt_secret_key: str = Field(min_length=32)
+    jwt_algorithm: str = "HS256"
+    jwt_issuer: str = "secure-ecommerce-api"
+    jwt_audience: str = "secure-ecommerce-clients"
+    access_token_expire_minutes: int = Field(default=30, ge=5, le=120)
+    auth_rate_limit_attempts: int = Field(default=5, ge=3, le=20)
+    auth_rate_limit_window_seconds: int = Field(default=300, ge=60, le=3600)
+    auth_rate_limit_max_buckets: int = Field(default=5000, ge=100, le=100_000)
+    log_level: str = "INFO"
+    demo_seed_products: bool = False
+    demo_product_count: int = Field(default=220, ge=0, le=1000)
+
+    model_config = SettingsConfigDict(
+        env_file=".env",
+        env_file_encoding="utf-8",
+        case_sensitive=False,
+        extra="ignore",
+    )
+
+    @field_validator("jwt_secret_key")
+    @classmethod
+    def validate_jwt_secret_key(cls, value: str) -> str:
+        insecure_values = {
+            "change-this-secret-in-production",
+            "replace-with-a-long-random-secret",
+        }
+        if value in insecure_values:
+            raise ValueError("JWT_SECRET_KEY must be replaced with a strong random secret")
+        return value
+
+    @field_validator("database_url")
+    @classmethod
+    def validate_database_url(cls, value: str) -> str:
+        sqlite_prefix = "sqlite:///"
+        if not value.startswith(sqlite_prefix):
+            return value
+
+        raw_path = value[len(sqlite_prefix):]
+        if raw_path == ":memory:":
+            return value
+        if (
+            len(raw_path) >= 3
+            and raw_path[1] == ":"
+            and raw_path[0].isalpha()
+            and raw_path[2] in {"/", "\\"}
+        ):
+            raise ValueError(
+                "SQLite database file must stay inside the project directory"
+            )
+
+        candidate = Path(raw_path)
+        resolved = candidate.resolve() if candidate.is_absolute() else (PROJECT_ROOT / candidate).resolve()
+        try:
+            resolved.relative_to(PROJECT_ROOT)
+        except ValueError as exc:
+            raise ValueError("SQLite database file must stay inside the project directory") from exc
+
+        normalized_relative_path = resolved.relative_to(PROJECT_ROOT).as_posix()
+        return f"{sqlite_prefix}./{normalized_relative_path}"
+
+
+@lru_cache
+def get_settings() -> Settings:
+    return Settings()  # type: ignore[call-arg]