CI Workflow

.env_template

@@ -0,0 +1,25 @@
+SECRET_KEY=
+DEBUG=false
+DATABASE_URL=postgres://postgres:postgres@localhost:5432/connect
+CELERY_BROKER_URL=redis://localhost:6379/0
+REDIS_URL=redis://localhost:6379/0
+DJANGO_ALLOWED_HOSTS=
+CSRF_TRUSTED_ORIGINS=
+
+TWILIO_ACCOUNT_SID=
+TWILIO_AUTH_TOKEN=
+TWILIO_MESSAGING_SERVICE=
+
+FCM_PROJECT_ID=
+FCM_PRIVATE_KEY_ID=
+FCM_CLIENT_EMAIL=
+FCM_CLIENT_ID=
+FCM_CLIENT_X509_CERT_URL=
+FCM_PRIVATE_KEY=
+
+OIDC_RSA_PRIVATE_KEY=
+
+APP_HASH=
+SENTRY_DSN=
+SENTRY_ENVIRONMENT=
+SENTRY_TRACES_SAMPLE_RATE=

.github/workflows/ci.yaml

@@ -0,0 +1,63 @@
+name: CI
+
+# Enable Buildkit and let compose use it to speed up image building
+env:
+  DOCKER_BUILDKIT: 1
+  COMPOSE_DOCKER_CLI_BUILD: 1
+
+on:
+  pull_request:
+    branches: ['main']
+
+  push:
+    branches: ['main']
+
+concurrency:
+  group: ${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  linter:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code Repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.11'
+      - name: Run pre-commit
+        uses: pre-commit/[email protected]
+
+  pytest:
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        image: postgres:12
+        ports:
+          - 5432:5432
+        env:
+          POSTGRES_PASSWORD: postgres
+
+    env:
+      DATABASE_URL: 'postgres://postgres:postgres@localhost:5432/postgres'
+
+    steps:
+      - name: Checkout Code Repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.11'
+          cache: pip
+          cache-dependency-path: requirements-dev.txt
+
+      - name: Install Dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements-dev.txt
+      - name: Test with pytest
+        run: pytest

.gitignore

@@ -10,3 +10,5 @@
 /.idea
 /.direnv
 /.envrc
+*.env
+!*.env_example

.pre-commit-config.yaml

@@ -0,0 +1,57 @@
+default_stages: [pre-commit]
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-json
+      - id: check-toml
+      - id: check-xml
+      - id: check-yaml
+      - id: debug-statements
+      - id: check-builtin-literals
+      - id: check-case-conflict
+      - id: check-docstring-first
+      - id: detect-private-key
+
+  - repo: https://github.com/pre-commit/mirrors-prettier
+    rev: v3.0.0-alpha.9-for-vscode
+    hooks:
+      - id: prettier
+        args: ['--tab-width', '2', '--single-quote']
+        exclude: 'templates/'
+
+  - repo: https://github.com/adamchainz/django-upgrade
+    rev: '1.13.0'
+    hooks:
+      - id: django-upgrade
+        args: ['--target-version', '4.1']
+
+  - repo: https://github.com/asottile/pyupgrade
+    rev: v3.4.0
+    hooks:
+      - id: pyupgrade
+        args: [--py311-plus]
+
+  - repo: https://github.com/psf/black
+    rev: 23.3.0
+    hooks:
+      - id: black
+
+  - repo: https://github.com/PyCQA/isort
+    rev: 5.12.0
+    hooks:
+      - id: isort
+
+  - repo: https://github.com/PyCQA/flake8
+    rev: 6.0.0
+    hooks:
+      - id: flake8
+
+# sets up .pre-commit-ci.yaml to ensure pre-commit dependencies stay up to date
+ci:
+  autoupdate_schedule: weekly
+  skip: []
+  submodules: false

connectid/settings.py

@@ -10,20 +10,20 @@
 https://docs.djangoproject.com/en/4.1/ref/settings/
 """
 import logging
-import os
-import sentry_sdk
-
 from pathlib import Path
+
+import environ
+import sentry_sdk
 from sentry_sdk.integrations.celery import CeleryIntegration
 from sentry_sdk.integrations.django import DjangoIntegration
-from sentry_sdk.integrations.logging import LoggingIntegration, ignore_logger
+from sentry_sdk.integrations.logging import LoggingIntegration
 from sentry_sdk.integrations.redis import RedisIntegration
 
-
 # Build paths inside the project like this: BASE_DIR / 'subdir'.
 BASE_DIR = Path(__file__).resolve().parent.parent
 
-env = os.environ
+env = environ.Env()
+env.read_env(str(BASE_DIR / ".env"))
 
 # Quick-start development settings - unsuitable for production
 # See https://docs.djangoproject.com/en/4.1/howto/deployment/checklist/
@@ -87,7 +87,6 @@
 
 WSGI_APPLICATION = 'connectid.wsgi.application'
 
-
 TRUSTED_COMMCAREHQ_HOSTS = [
     "www.commcarehq.org",
     "commcarehq.org",
@@ -143,7 +142,7 @@
         }
     },
     'handlers': {
-        'file' : {
+        'file': {
             'level': 'INFO',
             'class': 'logging.handlers.RotatingFileHandler',
             'filename': DJANGO_LOG_FILE,
@@ -173,7 +172,6 @@
     },
 }
 
-
 REST_FRAMEWORK = {
     'DEFAULT_AUTHENTICATION_CLASSES': [
         'rest_framework.authentication.BasicAuthentication',
@@ -195,7 +193,6 @@
     "ALLOWED_VERSIONS": ["1.0"]
 }
 
-
 AXES_COOLOFF_TIME = 6
 AXES_IPWARE_META_PRECEDENCE_ORDER = [
     'HTTP_X_FORWARDED_FOR',
@@ -204,19 +201,6 @@
 
 LOGIN_URL = '/admin/login/'
 
-OAUTH2_PROVIDER = {
-    "OIDC_ENABLED": True,
-    "OIDC_RSA_PRIVATE_KEY": """
-INSERT PRIVATE KEY HERE
-""",
-    "SCOPES": {
-        "openid": "OpenID Connect scope",
-    },
-    "PKCE_REQUIRED": False,
-    "OAUTH2_VALIDATOR_CLASS": "users.oauth.ConnectOAuth2Validator",
-    # ... any other settings you want
-}
-
 FCM_CREDENTIALS = None
 
 FCM_DJANGO_SETTINGS = {
@@ -229,25 +213,16 @@
 
 SITE_ID = 1
 
-APP_HASH = "apphash"
+APP_HASH = env("APP_HASH", default="apphash")
 
-SENTRY_DSN = None
-SENTRY_ENVIRONMENT = "local"
-SENTRY_TRACES_SAMPLE_RATE = 0.0
-
-
-from .localsettings import *
-
-# Firebase
-if FCM_CREDENTIALS:
-    from firebase_admin import credentials, initialize_app
-    creds = credentials.Certificate(FCM_CREDENTIALS)
-    default_app = initialize_app(credential=creds)
+SENTRY_DSN = env("SENTRY_DSN", default=None)
+SENTRY_ENVIRONMENT = env("SENTRY_ENVIRONMENT", default="local")
+SENTRY_TRACES_SAMPLE_RATE = env("SENTRY_TRACES_SAMPLE_RATE", default="0.0")
 
 CELERY_TASK_ALWAYS_EAGER = True
 CELERY_TASK_EAGER_PROPAGATES = True
 
-CELERY_BROKER_URL = env.get("CELERY_BROKER_URL", default="redis://localhost:6379/0")
+CELERY_BROKER_URL = env("CELERY_BROKER_URL", default="redis://localhost:6379/0")
 
 if SENTRY_DSN:
     sentry_logging = LoggingIntegration(
@@ -267,3 +242,62 @@
         environment=SENTRY_ENVIRONMENT,
         traces_sample_rate=SENTRY_TRACES_SAMPLE_RATE,
     )
+
+SECRET_KEY = env(
+    "SECRET_KEY",
+    default="django-insecure-yofpqrszrdtv0ftihjd09cuim2al9^n9j^b85%-y0v*^_lj18d",
+)
+
+# SECURITY WARNING: don't run with debug turned on in production!!
+DEBUG = env("DEBUG", default=False)
+
+DATABASES = {
+    "default": env.db(
+        "DATABASE_URL",
+        default="postgres:///connect",
+    ),
+}
+
+ALLOWED_HOSTS = ["127.0.0.1", "localhost", "commcarehq.org"] + env.list(
+    "DJANGO_ALLOWED_HOSTS", default=[]
+)
+
+CSRF_TRUSTED_ORIGINS = env.list("CSRF_TRUSTED_ORIGINS", default=[])
+
+TWILIO_ACCOUNT_SID = env("TWILIO_ACCOUNT_SID", default=None)
+TWILIO_AUTH_TOKEN = env("TWILIO_AUTH_TOKEN", default=None)
+TWILIO_MESSAGING_SERVICE = env("TWILIO_MESSAGING_SERVICE", default=None)
+
+OAUTH2_PROVIDER = {
+    "OIDC_ENABLED": True,
+    "OIDC_RSA_PRIVATE_KEY": env("OIDC_RSA_PRIVATE_KEY", default=""),
+    "SCOPES": {
+        "openid": "OpenID Connect scope",
+        "sync": "sync with commcarehq"
+    },
+    "PKCE_REQUIRED": False,
+    "OAUTH2_VALIDATOR_CLASS": "users.oauth.ConnectOAuth2Validator",
+}
+
+FCM_PRIVATE_KEY = env("FCM_PRIVATE_KEY", default="")
+
+if FCM_PRIVATE_KEY:
+    FCM_CREDENTIALS = {
+        "type": "service_account",
+        "project_id": env("FCM_PROJECT_ID", default=""),
+        "private_key_id": env("FCM_PRIVATE_KEY_ID", default=""),
+        "private_key": FCM_PRIVATE_KEY,
+        "client_email": env("FCM_CLIENT_EMAIL", default=""),
+        "client_id": env("FCM_CLIENT_ID", default=""),
+        "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+        "token_uri": "https://oauth2.googleapis.com/token",
+        "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
+        "client_x509_cert_url": env("FCM_CLIENT_X509_CERT_URL", default=""),
+        "universe_domain": "googleapis.com",
+    }
+
+    # Firebase
+    from firebase_admin import credentials, initialize_app
+
+    creds = credentials.Certificate(FCM_CREDENTIALS)
+    default_app = initialize_app(credential=creds)