intent/config/settings/dev.py

from .base import *  # noqa: F403

DEBUG = True
SECRET_KEY = SECRET_KEY or "dev-insecure-secret-key"  # noqa: F405
ALLOWED_HOSTS = ["localhost", "127.0.0.1", "[::1]"]

DATA_DIR.mkdir(exist_ok=True)  # noqa: F405
# Avoid needing `createcachetable` for local development.
CACHES = {"default": {"BACKEND": "django.core.cache.backends.locmem.LocMemCache"}}
Scaffold Phase 0: Django project, deploy config, base layout Django 5.2 with dev/test/prod settings, SQLite tuned for Litestream (WAL, IMMEDIATE transactions), ULID primary keys via a shared base model, and a custom User model ahead of the first migration. Minimal accessible base template with dark mode via color-scheme and an optional theme picker. /healthz answers before host validation so Fly checks pass. Dockerfile (dev and prod targets), compose for local dev, fly.toml with placeholder app/region, Litestream backups to B2, and a Forgejo Actions workflow. Migrations run in bin/start because Fly release machines don't mount volumes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> 2026-10-27 06:59:34 -04:00			`from .base import * # noqa: F403`

			`DEBUG = True`
			`SECRET_KEY = SECRET_KEY or "dev-insecure-secret-key" # noqa: F405`
			`ALLOWED_HOSTS = ["localhost", "127.0.0.1", "[::1]"]`
Add accounts and organizations (Phase 1) Sign-in via django-allauth: emailed one-time codes, GitHub, Discord, and Forgejo instances as OpenID Connect apps registered in admin. Regular users never have a password; sysadmins sign in only at /admin/ and are redirected there from the normal sign-in. Organizations at the URL root with owner and collaborator roles, a per-member project-create grant, and invites by username or email. Email invites carry a bearer token stored only as a hash. The last owner can't leave, be removed or be demoted. Permission checks live in intent/access.py. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> 2026-10-27 07:10:27 -04:00
			`DATA_DIR.mkdir(exist_ok=True) # noqa: F405`
Harden auth, invites and deployment after security review - Signed-out visitors get the same login redirect for missing and private projects, so the redirect no longer reveals private ones. - Production refuses the console email backend; sign-in codes must never reach the logs. - Database cache shared by all workers for allauth rate limits; invite sending throttled per sender and per recipient. - Email invite links are claimed on first use and the token rotated, so a token copied from request logs is worthless. - allauth password URLs removed; adding an email requires a fresh code and notifies existing addresses. - Markdown drops remote images until uploads exist. - Project and org slugs lowercased; only superusers can grant staff status or permissions in the admin. - Container runs as a non-root user; CI actions pinned to commits. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> 2026-10-27 08:42:19 -04:00			# Avoid needing `createcachetable` for local development.
			`CACHES = {"default": {"BACKEND": "django.core.cache.backends.locmem.LocMemCache"}}`