Alec Perkins
604c2bbf91
- Rate limits in the shared cache for comments, issues, uploads and invites; a limited HTMX reply keeps the draft. - Content-Security-Policy (self only, no inline script or style, bucket origin for images and frames) and Permissions-Policy on every page. htmx configured not to inject styles or eval. - Moderation: deactivating a user ends their sessions and keeps their content; deleted accounts show as "ghost"; reserved usernames; the admin won't delete an org's last owner. - Admin requires a TOTP code (django-otp), with add_admin_totp to enrol. - Email provider chosen by environment through django-anymail. - Playwright browser tests: axe WCAG 2.1 AA on every page in light and dark, no CSP violations, keyboard walkthrough, theme toggle. Explicit Canvas/CanvasText on :root fixes dark-mode contrast detection. - bin/start creates the data dir if missing; docs/operations.md runbook. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
14 lines
499 B
Python
14 lines
499 B
Python
import os
|
|
|
|
from .base import * # noqa: F403
|
|
|
|
DEBUG = True
|
|
SECRET_KEY = SECRET_KEY or "dev-insecure-secret-key" # noqa: F405
|
|
ALLOWED_HOSTS = ["localhost", "127.0.0.1", "[::1]"]
|
|
|
|
DATA_DIR.mkdir(exist_ok=True) # noqa: F405
|
|
# Avoid needing `createcachetable` for local development.
|
|
CACHES = {"default": {"BACKEND": "django.core.cache.backends.locmem.LocMemCache"}}
|
|
|
|
# Plain password admin locally, unless you want to try the real thing.
|
|
ADMIN_REQUIRE_OTP = os.environ.get("ADMIN_REQUIRE_OTP") == "1"
|