gurixandClaude
5675784502
This commit implements all remaining polish tasks (T193-T210) to make the application production-ready. ## Logging & Monitoring (T193, T194, T208, T209) - Add structured JSON logging for production environments - Add human-readable logging for development - Implement comprehensive error logging across all routes: * submission.py: product access, validation, success/failure * auth.py: login attempts, successes, failures, logouts * dashboard.py: access and errors - Add /health endpoint for monitoring (checks data dir, API key) - Add environment variable validation on startup ## Security Hardening (T196-T199, T207) - Add HSTS headers in production (1 year, includeSubDomains) - Add security headers: X-Content-Type-Options, X-Frame-Options, X-XSS-Protection - Verify CSRF protection on all POST routes (Flask-WTF) - Verify session cookie security flags (HttpOnly, Secure, SameSite) - Verify XSS prevention (Jinja2 auto-escaping) - Verify no hardcoded secrets (only in test files) ## Documentation (T195, T203, T210) - Add comprehensive README.md with: * Features, quick start, project structure * Usage guides (end users, product owners, admins) * Configuration, testing, deployment instructions - Add detailed docs/deployment.md with: * Production deployment steps * ClamAV, Nginx, SSL/TLS setup * Security hardening, monitoring, backup strategies - Add requirements-dev.txt for development dependencies ## Performance Testing (T200, T201) - Add test_performance.py with 4 comprehensive tests: * 100 concurrent submissions (SC-012) * Dashboard load <3s for 1000 items (SC-008) * Large file upload handling * Rate limiting verification - Add performance marker to pytest.ini ## Testing - All 49 tests passing, 1 skipped - Fixed error handling to preserve HTTP status codes Phase 7 complete. Application is production-ready with comprehensive logging, security, monitoring, and documentation. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
49 lines
1.6 KiB
Python
49 lines
1.6 KiB
Python
"""Production configuration"""
|
|
import os
|
|
|
|
class ProductionConfig:
|
|
"""Production environment configuration"""
|
|
DEBUG = False
|
|
TESTING = False
|
|
|
|
# Security
|
|
SECRET_KEY = os.environ.get('SECRET_KEY') # Required in production
|
|
if not SECRET_KEY:
|
|
raise ValueError("SECRET_KEY environment variable must be set in production")
|
|
|
|
# Paths
|
|
DATA_DIR = os.environ.get('DATA_DIR', '/var/lib/reklamator/data')
|
|
|
|
# Flask-WTF CSRF
|
|
WTF_CSRF_ENABLED = True
|
|
WTF_CSRF_TIME_LIMIT = None
|
|
|
|
# File Upload
|
|
MAX_CONTENT_LENGTH = int(os.environ.get('MAX_CONTENT_LENGTH', 10 * 1024 * 1024)) # 10MB
|
|
|
|
# AI Integration
|
|
ANTHROPIC_API_KEY = os.environ.get('ANTHROPIC_API_KEY') # Required
|
|
if not ANTHROPIC_API_KEY:
|
|
raise ValueError("ANTHROPIC_API_KEY environment variable must be set in production")
|
|
|
|
# ClamAV
|
|
CLAMD_SOCKET = os.environ.get('CLAMD_SOCKET', '/var/run/clamav/clamd.ctl')
|
|
|
|
# Rate Limiting
|
|
RATELIMIT_ENABLED = os.environ.get('RATE_LIMIT_ENABLED', 'true').lower() == 'true'
|
|
RATELIMIT_STORAGE_URL = 'memory://'
|
|
RATELIMIT_PER_HOUR = int(os.environ.get('RATE_LIMIT_PER_HOUR', 10))
|
|
|
|
# Session - HTTPS only
|
|
SESSION_COOKIE_SECURE = True # HTTPS only
|
|
SESSION_COOKIE_HTTPONLY = True
|
|
SESSION_COOKIE_SAMESITE = 'Lax'
|
|
PERMANENT_SESSION_LIFETIME = 86400 # 24 hours
|
|
|
|
# Security Headers (T196 - HSTS for HTTPS enforcement)
|
|
SEND_FILE_MAX_AGE_DEFAULT = 31536000 # 1 year for static files
|
|
STRICT_TRANSPORT_SECURITY = 'max-age=31536000; includeSubDomains' # HSTS: 1 year
|
|
X_CONTENT_TYPE_OPTIONS = 'nosniff'
|
|
X_FRAME_OPTIONS = 'DENY'
|
|
X_XSS_PROTECTION = '1; mode=block'
|