application-form-7/config.py

import os
from dotenv import load_dotenv

load_dotenv()


class Config:
    """Application configuration"""

    # Flask settings
    SECRET_KEY = os.getenv('SECRET_KEY', 'dev-secret-key-change-in-production')

    # Email settings
    MAIL_SERVER = os.getenv('MAIL_SERVER', 'smtp.gmail.com')
    MAIL_PORT = int(os.getenv('MAIL_PORT', 587))
    MAIL_USE_TLS = os.getenv('MAIL_USE_TLS', 'True') == 'True'
    MAIL_USERNAME = os.getenv('MAIL_USERNAME')
    MAIL_PASSWORD = os.getenv('MAIL_PASSWORD')
    MAIL_DEFAULT_SENDER = os.getenv('MAIL_DEFAULT_SENDER', 'noreply@example.com')

    # Company name for emails
    COMPANY_NAME = os.getenv('COMPANY_NAME', 'Unser Unternehmen')

    # HR notification settings
    HR_EMAIL = os.getenv('HR_EMAIL')
    APPLICATION_URL_BASE = os.getenv('APPLICATION_URL_BASE', 'http://localhost:5000')

    # Application settings
    APPLICATIONS_FOLDER = './applications'
    MAX_FILE_SIZE = 4 * 1024 * 1024  # 4 MB in bytes
    MAX_FILES = 3
    ALLOWED_EXTENSIONS = {'pdf', 'doc', 'docx', 'txt', 'jpg', 'jpeg', 'png'}

    # Text field limits
    MAX_STRING_LENGTH = 255
    MAX_TEXT_AREA_LENGTH = 3000  # Approximately one A4 page
    MAX_ZIP_DIGITS = 10

    # Birth year validation
    MIN_BIRTH_YEAR = 1940
    MAX_BIRTH_YEAR = 2010

    # Security settings
    WTF_CSRF_ENABLED = True
    WTF_CSRF_TIME_LIMIT = None  # CSRF tokens don't expire (user can take time filling forms)
    WTF_CSRF_SSL_STRICT = False  # Set to True in production with HTTPS
    SESSION_COOKIE_SECURE = False  # Set to True in production (HTTPS only)
    SESSION_COOKIE_HTTPONLY = True  # Prevent JavaScript access to session cookie
    SESSION_COOKIE_SAMESITE = 'Lax'  # CSRF protection

    # Rate limiting settings
    RATE_LIMIT_SECONDS = 5  # Minimum seconds between form submissions