invenio.cfg

"""
InvenioRDM settings for NYU Data Repository project.

This file was automatically generated by 'invenio-cli init'.

For the full list of settings and their values, see
https://invenio-app-rdm.readthedocs.io/en/latest/configuration.html
and the config.py files of your installed modules
https://invenio.readthedocs.io/en/latest/general/bundles.html

Only configuration created via cookiecutter or very likely to be edited
by installer are included here.
"""
import os
from datetime import timedelta
from dotenv import load_dotenv

from flask_babelex import lazy_gettext as _
from ultraviolet_saml.handlers import acs_handler_factory
from ultraviolet_permissions.policies import UltraVioletPermissionPolicy

# Flask
# =====
# See https://flask.palletsprojects.com/en/1.1.x/config/


#load configs from file. The .env file which comes here is a placeholder.
#it needs to be replaced
load_dotenv()
# SECURITY WARNING: keep the secret key used in production secret!
# TODO: Set
SECRET_KEY = os.getenv("FLASK_SECRET_KEY")
APP_ENVIRONMENT = os.getenv("APP_ENVIRONMENT","local")

if not SECRET_KEY:
    raise ValueError("No SECRET_KEY set for Flask application")

PERMANENT_SESSION_LIFETIME = timedelta(days=1)

# Since HAProxy and Nginx route all requests no matter the host header
# provided, the allowed hosts variable is set to localhost. In production it
# should be set to the correct host and it is strongly recommended to only
# route correct hosts to the application.
APP_ALLOWED_HOSTS = os.getenv("APP_ALLOWED_HOSTS",['0.0.0.0','localhost','127.0.0.1'])

# Flask-SQLAlchemy
# ================
# See https://flask-sqlalchemy.palletsprojects.com/en/2.x/config/

#Search hosts
SEARCH_HOSTS = os.getenv("SEARCH_HOSTS",[{'host':'localhost','port':9200,'timeout':160}])

# TODO: Set
SQLALCHEMY_DATABASE_URI = os.getenv("SQLALCHEMY_DATABASE_URI","postgresql+psycopg2://nyudatarepository:changeme@localhost/nyudatarepository")

# Invenio-App
# ===========
# See https://invenio-app.readthedocs.io/en/latest/configuration.html

APP_DEFAULT_SECURE_HEADERS = {
    'content_security_policy': {
        'default-src': [
            '*',
            "'self'",
            'fonts.googleapis.com',  # for fonts
            '*.gstatic.com',    # for fonts
            'data:', # for fonts
            "'unsafe-inline'",  # for inline scripts and styles
            "'unsafe-eval'", # for webpack build
            "blob:",            # for pdf preview
            # Add your own policies here (e.g. analytics)
        ],
    },
    'content_security_policy_report_only': False,
    'content_security_policy_report_uri': None,
    'force_file_save': False,
    'force_https': True,
    'force_https_permanent': False,
    'session_cookie_http_only': True,
    'session_cookie_secure': True,
    'strict_transport_security': True,
    'strict_transport_security_include_subdomains': True,
    'strict_transport_security_max_age': 31556926,  # One year in seconds
    'strict_transport_security_preload': False,
}

PREVIEWER_PREFERENCE = [
    "csv_dthreejs",
    "iiif_simple",
    'simple_image',
    'json_prismjs',
    'xml_prismjs',
    'mistune',
    'pdfjs',
    'ipynb',
    'gis',
    'zip',
    'txt'
]
#community
#COMMUNITIES_ENABLED =
COMMUNITIES_GROUPS_ENABLED = True

# DOI disabled and not configured
datacite_enabled = os.getenv("DATACITE_ENABLED","false")

if datacite_enabled.lower() == "true":
    datacite_enabled = True
else:
    datacite_enabled = False

DATACITE_ENABLED = datacite_enabled

DATACITE_USERNAME = os.getenv("DATACITE_USERNAME","")
DATACITE_PASSWORD = os.getenv("DATACITE_PASSWORD","")
DATACITE_PREFIX = os.getenv("DATACITE_PREFIX","")
DATACITE_TEST_MODE = os.getenv("DATACITE_TEST_MODE",True)


PROPAGATE_EXCEPTIONS = True
PIDSTORE_DATACITE_URL = "https://api.test.datacite.org"

# Flask-Babel
# ===========
# See https://flask-babel.tkte.ch/#configuration

# Default locale (language)
BABEL_DEFAULT_LOCALE = 'en'
# Default time zone
BABEL_DEFAULT_TIMEZONE = 'America/New_York'


# Invenio-I18N
# ============
# See https://invenio-i18n.readthedocs.io/en/latest/configuration.html

BABEL_DEFAULT_LOCALE = 'en'
# Other supported languages (do not include BABEL_DEFAULT_LOCALE in list).

PREVIEWER_CHARDET_BYTES = 8192
"""Number of bytes to read for character encoding detection by `cchardet`."""

FILES_REST_TASK_WAIT_MAX_SECONDS = 6000
FILES_REST_MULTIPART_CHUNKSIZE_MAX = 2 * 1024 * 1024 * 1024

# Disables requirement for user email confirmation
SECURITY_CONFIRMABLE = False

# Invenio-SAML Configuration
# ==========================
# See https://inveniordm.docs.cern.ch/customize/authentication/#saml-integration

SSO_SAML_DEFAULT_BLUEPRINT_PREFIX = '/saml'
"""Base URL for the extensions endpoint."""

SSO_SAML_DEFAULT_METADATA_ROUTE = '/metadata/<idp>'
"""URL route for the metadata request."""

SSO_SAML_DEFAULT_SSO_ROUTE = '/login/<idp>'
"""URL route for the SP login."""

SSO_SAML_DEFAULT_ACS_ROUTE = '/authorized/<idp>'
"""URL route to handle the IdP login request."""

SSO_SAML_DEFAULT_SLO_ROUTE = '/slo/<idp>'
"""URL route for the SP logout."""

SSO_SAML_DEFAULT_SLS_ROUTE = '/sls/<idp>'
"""URL route to handle the IdP logout request."""

SSO_SAML_IDP_NAME = os.getenv('IDP', 'nyu')

SSO_SAML_IDPS = {

    # name your authentication provider
    SSO_SAML_IDP_NAME: {

        # Basic info
        "title": "NYU Mock SAML",
        "description": "SAML Authentication Service for NYU Ultraviolet",
        "icon": "static/images/logo_ultraviolet_1word_white.svg",

        # path to the file i.e. "./saml/sp.crt"
        'sp_cert_file': os.getenv('SP_CERT','./certificate.pem'),

        # path to the file i.e. "./saml/sp.key"
        #'sp_key_file': os.getenv('SP_KEY','./sp.pem'),
        'sp_key_file': '/opt/ultraviolet/qaultraviolet_dlib_nyu_edu.key',

        'settings': {
            # If strict is True, then the Python Toolkit will reject unsigned
            # or unencrypted messages if it expects them to be signed or encrypted.
            # Also it will reject the messages if the SAML standard is not strictly
            # followed. Destination, NameId, Conditions ... are validated too.
            'strict': False,

            # Enable debug mode (outputs errors).
            'debug': True,

            # Service Provider Data that we are deploying.
            'sp': {

                # Specifies the constraints on the name identifier to be used to
                # represent the requested subject.
                # Take a look on https://github.com/onelogin/python-saml/blob/master/src/onelogin/saml2/constants.py
                # to see the NameIdFormat that are supported.
                'NameIDFormat': 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'
            },

            # Identity Provider Data that we want connected with our SP.
            'idp': {

                # Identifier of the IdP entity  (must be a URI)
                'entityId': os.getenv("IDP_METADATA",'http://localhost:8080/simplesaml/saml2/idp/metadata.php'),

                # SSO endpoint info of the IdP. (Authentication Request protocol)
                'singleSignOnService': {

                    # URL Target of the IdP where the Authentication Request Message
                    # will be sent.
                    'url': os.getenv("IDP_SSO",'http://localhost:8080/simplesaml/saml2/idp/SSOService.php'),

                    # SAML protocol binding to be used when returning the <Response>
                    # message. OneLogin Toolkit supports the HTTP-Redirect binding
                    # only for this endpoint.
                    'binding':
                        'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
                },

                # SLO endpoint info of the IdP.
                'singleLogoutService': {
                    # URL Location where the <LogoutRequest> from the IdP will be sent (IdP-initiated logout)
                    "url": os.getenv("IDP_SLO","http://localhost:8080/simplesaml/saml2/idp/SingleLogoutService.php"),

                    # SAML protocol binding to be used when returning the <Response>
                    # message. OneLogin Toolkit supports the HTTP-Redirect binding
                    # only for this endpoint.
                    "binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
                },
                # Public X.509 certificate of the IdP
                'x509cert': os.getenv('IDP_X509_CERT_SINGLE','')
            },

            # Security settings
            # more on https://github.com/onelogin/python-saml
            'security': {
                'allowRepeatAttributeName': True,
                'authnRequestsSigned': False,
                'failOnAuthnContextMismatch': False,
                'logoutRequestSigned': False,
                'logoutResponseSigned': False,
                'metadataCacheDuration': None,
                'metadataValidUntil': None,
                'nameIdEncrypted': False,
                'requestedAuthnContext': False,
                'requestedAuthnContextComparison': 'exact',
                'signMetadata': False,
                'signatureAlgorithm':
                    'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
                'wantAssertionsEncrypted': False,
                'wantAssertionsSigned': False,
                'wantAttributeStatement': False,
                'wantMessagesSigned': False,
                'wantNameId': True,
                'wantNameIdEncrypted': False,
                'digestAlgorithm':
                    'http://www.w3.org/2001/04/xmlenc#sha256'
            },
        },

        # Account Mapping as per NYU's available mappings. Please take a look here https://wikis.nyu.edu/download/attachments/40274104/SAMLShibbolethIntegrationGuidev2.1.pdf?version=1&modificationDate=1517176083918&api=v2
        "mappings": {
            "email": os.getenv("IDP_SAML_EMAIL", "urn:oid:1.3.6.1.7"),
            "name": os.getenv("IDP_SAML_NAME", "urn:oid:2.5.4.42"),
            "surname": os.getenv("IDP_SAML_SURNAME", "urn:oid:2.5.4.4"),
            "external_id": os.getenv("IDP_SAML_EXTERNALID", "urn:oid:0.9.2342.19200300.100.1.1")
        },

        # Default Affiliation to be assigned to all SAML logged in users - remove this if not required
        "default_affiliation": "New York University",

        # This is used to automatically set email and profile visibility to public to all SAML logged in users - remove this if not required
        "default_visibility": "public",

        # Inject your remote_app to handler
        # Note: keep in mind the string should match
        # given name for authentication provider
        'acs_handler': acs_handler_factory(SSO_SAML_IDP_NAME),

        # Auto confirms all SAML logged in users
        'auto_confirm': True
    }
}

if os.getenv('IDP_X509_CERT_SIGNING',''):
    SSO_SAML_IDPS[SSO_SAML_IDP_NAME]['settings']['idp']['x509certMulti'] = {
    'signing': [os.getenv('IDP_X509_CERT_SIGNING')],
    'encryption': [os.getenv('IDP_X509_CERT_ENCRYPTION')]
    }

SSO_SAML_ROLES = {
        # Default role to be assigned to all SAML logged in users - remove this if not required
        SSO_SAML_IDP_NAME: os.getenv("DEFAULT_SAML_ROLE", "defaultsamlrole"),
}

# The following is a hacky implementation. It should be False for a fresh invenio installation. After creating a community and adding the nyuusers role to the community, add the community ID as a list here
# For example: "auto_update_communities": ["c441b9c2-40e0-4035-96cc-8e13bd28d0f7"] where c441b9c2-40e0-4035-96cc-8e13bd28d0f7 is the community ID retrieved from the communities_metadata table. If one
# community is updated here, no need to update for subsequent communities, they add new group members automatically.
COMMUNITIES_AUTO_UPDATE = False  
OAUTHCLIENT_LOGIN_USER_TEMPLATE = "ultraviolet_saml/login_user.html"

# Custom Ultraviolet Permission Policy
RDM_PERMISSION_POLICY = UltraVioletPermissionPolicy
# Invenio-Theme
# =============
# See https://invenio-theme.readthedocs.io/en/latest/configuration.html

# Frontpage title
THEME_FRONTPAGE_TITLE = "Search UltraViolet"
# Header logo
THEME_LOGO = 'images/logo_ultraviolet_1word_white.svg'
# Site Name
THEME_SITENAME = 'UltraViolet'

# Default values for deposit form
APP_RDM_DEPOSIT_FORM_DEFAULTS = {
    "rights": [
        {
            "id": "cc-by-4.0",
            "title": "Creative Commons Attribution 4.0 International",
            "description": ("The Creative Commons Attribution license allows "
                            "re-distribution and re-use of a licensed work "
                            "on the condition that the creator is "
                            "appropriately credited."),
            "link": "https://creativecommons.org/licenses/by/4.0/legalcode",
        }
    ],
    "publisher": "NYU University",
}

#Behavior for autocomplete names search field for creators/contributors.
APP_RDM_DEPOSIT_FORM_AUTOCOMPLETE_NAMES = "off"

#Form quota
APP_RDM_DEPOSIT_FORM_QUOTA = {
    "maxFiles": 100,
    "maxStorage": 10 ** 9 * 50,
}

# Invenio-App-RDM
# ===============
# See https://invenio-app-rdm.readthedocs.io/en/latest/configuration.html

# Instance's theme entrypoint file. Path relative to the ``assets/`` folder.
INSTANCE_THEME_FILE = './less/theme.less'

# Allow access to old admin panel
ADMIN_ROLE = "admin"
ADMIN_PERMISSION_FACTORY = "ultraviolet_permissions.policies.ultraviolet_admin_permission_factory"

# Invenio-Records-Resources
# =========================
# See https://github.com/inveniosoftware/invenio-records-resources/blob/master/invenio_records_resources/config.py

# TODO: Set with your own hostname when deploying to production
SITE_UI_URL = os.getenv("SITE_UI_URL","https://127.0.0.1:5000")

SITE_API_URL = os.getenv("SITE_API_URL","https://127.0.0.1:5000/api")
#Local login settings
SECURITY_REGISTERABLE = False  # local login: allow users to register
SECURITY_RECOVERABLE = True  # local login: allow users to reset the password
SECURITY_CHANGEABLE = True  # local login: allow users to change password
SECURITY_CONFIRMABLE = False  # require users to confirm their e-mail address

#File integrity report

APP_RDM_ADMIN_EMAIL_RECIPIENT = "uv@nyu.edu"
MAIL_DEFAULT_SENDER = "uv@nyu.edu"
FILES_INTEGRITY_REPORT_SUBJECT = "File integrity report"
MAIL_SUPPRESS_SEND = False

#Allow download all
RDM_ARCHIVE_DOWNLOAD_ENABLED = True

#build webpack no symlinks (only needed in production)
if APP_ENVIRONMENT == 'global':
  COLLECT_STORAGE = 'flask_collect.storage.file'
  COLLECT_STATIC_ROOT = os.getenv("COLLECT_STATIC_ROOT", '/opt/static')

if APP_ENVIRONMENT == 'local':
  RDM_RECORDS_USER_FIXTURE_PASSWORDS = {
   'adminUV@test.com': 'adminUV',
  }

# UltraViolet custom vars
# =======================

UV_VERSION              = open(".uv-version", "r").read().strip()
UV_DEPOSIT_REQUEST      = 'https://nyu.qualtrics.com/jfe/form/SV_exhm5HuMKRdW0hU'
UV_FAQS                 = 'https://guides.nyu.edu/ultraviolet/faq'

RDM_HOMEPAGE            = 'https://inveniosoftware.org/products/rdm'
DATA_SERVICES_HOMEPAGE  = 'https://guides.nyu.edu/dataservices'

# About UltraViolet
UV_DEPOSIT_ASSISTANCE   = 'https://library.answers.nyu.edu/form?queue_id=6256'
UV_SERVICE_POLICIES     = 'https://guides.nyu.edu/ultraviolet/policies'
UV_DOCS                 = 'https://guides.nyu.edu/ultraviolet/'
UV_TECH_DOCS            = 'https://nyudlts.github.io/ultraviolet/'

# Partnerships
DLTS_HOMEPAGE           = 'https://wp.nyu.edu/library-dlts/'
DS_HOMEPAGE             = 'https://guides.nyu.edu/dataservices'
DCN_HOMEPAGE            = 'https://datacurationnetwork.org/'
RDM_DOCS_HOMEPAGE       = 'http://inveniordm.docs.cern.ch'

# Resources
UV_DEPOSIT_GUIDE        = 'https://guides.nyu.edu/ultraviolet/deposit'
SCIP_HOMEPAGE           = 'https://library.nyu.edu/departments/scholarly-communications-information-policy/'
NYU_LIBRARIES_HOMEPAGE  = 'https://library.nyu.edu'

# Max file size for displaying download buttons and link (50 GB)
MAX_FILE_SIZE = 50 * 1024 * 1024 * 1024