Prepare ERP source for Gitea deployment

app/core/settings.py

@@ -0,0 +1,76 @@
+from functools import lru_cache
+from pydantic_settings import BaseSettings, SettingsConfigDict
+from pydantic import Field
+
+
+class Settings(BaseSettings):
+    model_config = SettingsConfigDict(
+        env_file=".env",
+        env_file_encoding="utf-8",
+        extra="ignore"
+    )
+
+    APP_NAME: str = "Audit_Firm_v2.0.3.6"
+    ENV: str = "dev"
+    DEBUG: bool = True
+    SECRET_KEY: str = "change-me-to-a-long-random-string"
+
+    COOKIE_SECURE: bool = False
+    COOKIE_SAMESITE: str = "lax"
+    COOKIE_SESSION_NAME: str = "af2sid"
+
+    DB_BACKEND: str = Field(default="sqlite", description="sqlite|postgres")
+
+    SQLITE_COMMON_PATH: str = "./data/common.db"
+
+    PG_HOST: str = "127.0.0.1"
+    PG_PORT: int = 5432
+    PG_USER: str = "postgres"
+    PG_PASSWORD: str = "postgres"
+    PG_DB_COMMON: str = "audit_common"
+
+    DEFAULT_TENANT_CODE: str = "default"
+    DEFAULT_BRANCH_CODE: str = "main"
+    DEFAULT_YEAR_CODE: str = "2025-26"
+    DEFAULT_TIMEZONE: str = "Asia/Kolkata"
+
+    # Public base URL used for email links such as invite and password reset.
+    # In Coolify production set this to https://your-erp-domain.
+    ERP_PUBLIC_BASE_URL: str = "http://localhost:8000"
+
+    # Print OTP to server logs only in local/dev troubleshooting. Keep false in UAT/production.
+    DEV_AUTH_OTP_PRINT: bool = False
+
+    # Context headers are disabled by default for public deployments.
+    # When disabled, browser/client supplied X-Tenant-Code, X-Branch-Code,
+    # and X-Year-Code are ignored. Enable only for trusted internal runners
+    # or reverse proxies that also restrict/strip external request headers.
+    TRUST_CONTEXT_HEADERS: bool = False
+    TRUST_CONTEXT_HEADER_HOSTS: str = "127.0.0.1,localhost,::1"
+    CONTEXT_HEADER_SECRET: str = ""
+
+    # JWT Configuration
+    JWT_ISSUER: str = "Audit_Firm_v2.0.3.6"
+    JWT_AUDIENCE: str = "audit_firm_clients"
+    JWT_ACCESS_MINUTES: int = 15
+    JWT_REFRESH_DAYS: int = 30
+
+    # Bootstrap Admin
+    BOOTSTRAP_ADMIN_EMAIL: str = "admin@auditfirm.local"
+    BOOTSTRAP_ADMIN_PASSWORD: str = "ChangeMe@123"
+
+    INVITE_TOKEN_HOURS: int = 72
+    PASSWORD_RESET_HOURS: int = 2
+    PASSWORD_MIN_LENGTH: int = 8
+
+
+@lru_cache
+def get_settings() -> Settings:
+    s = Settings()
+
+    # Normalize cookie values
+    s.COOKIE_SAMESITE = (s.COOKIE_SAMESITE or "lax").lower()
+    if s.COOKIE_SAMESITE not in {"lax", "strict", "none"}:
+        s.COOKIE_SAMESITE = "lax"
+
+    return s