Fix/set csrf cookie on login

.docker/Dockerfile.debug.api

@@ -0,0 +1,21 @@
+FROM python:3.8.14-slim-buster
+
+RUN mkdir /badgr_server
+WORKDIR /badgr_server
+
+RUN apt-get clean all && apt-get update && apt-get upgrade -y
+RUN apt-get install -y default-libmysqlclient-dev \
+                       python3-dev \
+                       python3-cairo \
+                       build-essential \
+                       xmlsec1 \
+                       libxmlsec1-dev \
+                       pkg-config \
+                       curl
+
+RUN pip install uwsgi
+
+COPY requirements.txt              /badgr_server
+
+RUN pip --timeout=1000 install --no-dependencies -r requirements.txt
+RUN pip --timeout=1000 install debugpy

.docker/Dockerfile.dev.api

@@ -1,18 +1,49 @@
-FROM python:3.8-slim
+FROM python:3.8.14-slim-buster
 
 RUN mkdir /badgr_server
 WORKDIR /badgr_server
 
-RUN apt-get update && apt-get upgrade -y
+RUN apt-get clean all && apt-get update && apt-get upgrade -y
 RUN apt-get install -y default-libmysqlclient-dev \
-                       python3-dev \
-                       python3-cairo \
-                       build-essential \
-                       xmlsec1 \
-                       libxmlsec1-dev \
-                       pkg-config
+    python3-dev \
+    python3-cairo \
+    build-essential \
+    xmlsec1 \
+    libxmlsec1-dev \
+    pkg-config \
+    default-mysql-client \
+    git \
+    curl
 
 RUN pip install uwsgi
 
 COPY requirements.txt              /badgr_server
-RUN pip install -r requirements.txt
+
+COPY entrypoint.dev.sh             /badgr_server
+
+COPY crontab                       /etc/cron.d/crontab
+
+COPY openbadges                    /badgr_server
+
+COPY openbadges_bakery             /badgr_server
+
+RUN chmod +x entrypoint.dev.sh
+
+RUN touch /var/log/cron_cleartokens.log && chmod 644 /var/log/cron_cleartokens.log
+RUN touch /var/log/cron_qr_badgerequests.log && chmod 644 /var/log/cron_qr_badgerequests.log
+
+ENV SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.30/supercronic-linux-amd64 \
+    SUPERCRONIC=supercronic-linux-amd64 \
+    SUPERCRONIC_SHA1SUM=9f27ad28c5c57cd133325b2a66bba69ba2235799
+
+RUN curl -fsSLO "$SUPERCRONIC_URL" \
+    && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
+    && chmod +x "$SUPERCRONIC" \
+    && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
+    && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic
+
+
+RUN pip --timeout=1000 install --no-dependencies -r requirements.txt
+RUN pip --timeout=1000 install debugpy
+
+ENTRYPOINT ["/badgr_server/entrypoint.dev.sh"]

.docker/Dockerfile.prod.api

@@ -1,23 +1,71 @@
-FROM python:3.8-slim
+# Best practies taken from here: https://snyk.io/blog/best-practices-containerizing-python-docker/
+
+# ------------------------------> Build image
+FROM python:3.8.14-slim-buster as build
+RUN apt-get clean all && apt-get update
+RUN apt-get install -y default-libmysqlclient-dev \
+    python3-dev \
+    python3-cairo \
+    build-essential \
+    xmlsec1 \
+    libxmlsec1-dev \
+    pkg-config \
+    cron
 
 RUN mkdir /badgr_server
 WORKDIR /badgr_server
+RUN python -m venv /badgr_server/venv
+ENV PATH="/badgr_server/venv/bin:$PATH"
 
-RUN apt-get update && apt-get upgrade -y
+COPY requirements.txt .
+RUN pip install --no-dependencies -r requirements.txt
+
+# ------------------------------> Final image
+FROM python:3.8.14-slim-buster
+RUN apt-get update
 RUN apt-get install -y default-libmysqlclient-dev \
-                       python3-dev \
-                       python3-cairo \
-                       build-essential \
-                       xmlsec1 \
-                       libxmlsec1-dev \
-                       pkg-config
-
-COPY requirements.txt                   /badgr_server
-COPY manage.py                          /badgr_server
-COPY .docker/etc/uwsgi.ini              /badgr_server
-COPY .docker/etc/wsgi.py                /badgr_server
-COPY apps                               /badgr_server/apps
-COPY .docker/etc/settings_local.py      /badgr_server/apps/mainsite/
-
-RUN pip install uwsgi
-RUN pip install -r requirements.txt
+    python3-cairo \
+    git \
+    libxml2 \
+    default-mysql-client \
+    cron \
+    curl
+
+RUN groupadd -g 999 python && \
+    useradd -r -u 999 -g python python
+
+RUN mkdir /badgr_server && chown python:python /badgr_server
+RUN mkdir /backups && chown python:python /backups
+
+WORKDIR /badgr_server
+
+# Copy installed dependencies
+COPY --chown=python:python --from=build /badgr_server/venv /badgr_server/venv
+
+# Copy everything related Django stuff
+COPY --chown=python:python  manage.py                          .
+COPY --chown=python:python  .docker/etc/uwsgi.ini              .
+COPY --chown=python:python  .docker/etc/wsgi.py                .
+COPY --chown=python:python  apps                               ./apps
+COPY --chown=python:python  openbadges                         ./openbadges
+COPY --chown=python:python  openbadges_bakery                  ./openbadges_bakery
+COPY --chown=python:python  .docker/etc/settings_local.py      ./apps/mainsite/
+COPY --chown=python:python  entrypoint.sh                      .
+
+RUN chmod +x entrypoint.sh
+
+# Latest releases available at https://github.com/aptible/supercronic/releases
+ENV SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.30/supercronic-linux-amd64 \
+    SUPERCRONIC=supercronic-linux-amd64 \
+    SUPERCRONIC_SHA1SUM=9f27ad28c5c57cd133325b2a66bba69ba2235799
+
+RUN curl -fsSLO "$SUPERCRONIC_URL" \
+    && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
+    && chmod +x "$SUPERCRONIC" \
+    && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
+    && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic
+
+USER 999
+
+ENV PATH="/badgr_server/venv/bin:$PATH"
+ENTRYPOINT ["./entrypoint.sh"]

.docker/etc/nginx.conf → .docker/config/nginx/nginx.conf

@@ -17,6 +17,11 @@ http {
     sendfile        on;
 
     keepalive_timeout  65;
+    client_max_body_size 10M;
+
+    proxy_read_timeout 300;
+    proxy_connect_timeout 300;
+    proxy_send_timeout 300;
 
     gzip on;
     gzip_types text/plain application/xml;

.docker/etc/site.conf → .docker/config/nginx/sites-available/site.conf

@@ -8,7 +8,7 @@ server {
 
     location /media  {
          alias /mediafiles;
-         add_header Access-Control-Allow-Origin "https://mybadges.org";
+         add_header Access-Control-Allow-Origin "https://openbadges.education";
     }
 
     location /static {

.docker/etc/init.sql

@@ -1 +1 @@
-CREATE DATABASE IF NOT EXISTS badgr;
+CREATE DATABASE IF NOT EXISTS badgr SET utf8mb4 COLLATE utf8mb4_general_ci;

.docker/etc/settings_local.dev.py.example

@@ -28,7 +28,8 @@ DATABASES = {
         'HOST': 'db',
         'PORT': '',
         'OPTIONS': {
-#            "SET character_set_connection=utf8mb3, collation_connection=utf8_unicode_ci",  # Uncomment when using MySQL to ensure consistency across servers
+            'charset': 'utf8mb4',
+            'init_command': "SET NAMES 'utf8mb4' COLLATE 'utf8mb4_general_ci'"
         },
     }
 }
@@ -41,7 +42,7 @@ DATABASES = {
 ###
 CACHES = {
      'default': {
-         'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache',
+         'BACKEND': 'django.core.cache.backends.memcached.PyMemcacheCache',
          'LOCATION': 'memcached:11211',
          'KEY_FUNCTION': 'mainsite.utils.filter_cache_key'
      }
@@ -57,6 +58,10 @@ CACHES = {
 DEFAULT_FROM_EMAIL = ''  # e.g. "noreply@example.com"
 EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend'
 
+# use these settings if you want to use mailhog instead of console backend
+# EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
+# EMAIL_HOST = 'mailhog'
+# EMAIL_PORT = 1025
 
 ###
 #
@@ -148,4 +153,26 @@ LOGGING = {
 }
 
 NOUNPROJECT_API_KEY = ''
-NOUNPROJECT_SECRET = ''
+NOUNPROJECT_SECRET = ''
+
+AISKILLS_API_KEY = ''
+AISKILLS_ENDPOINT_CHATS = ''
+AISKILLS_ENDPOINT_KEYWORDS = ''
+
+OIDC_RP_CLIENT_ID = ''
+OIDC_RP_CLIENT_SECRET = ''
+OIDC_OP_AUTHORIZATION_ENDPOINT = ''
+OIDC_OP_TOKEN_ENDPOINT = ''
+OIDC_OP_USER_ENDPOINT = ''
+OIDC_OP_JWKS_ENDPOINT = ''
+OIDC_OP_END_SESSION_ENDPOINT = ''
+LOGIN_BASE_URL = ''
+
+# Don't change these
+LOGIN_REDIRECT_URL = f'{LOGIN_BASE_URL}?validateToken'
+LOGOUT_REDIRECT_URL = f'{LOGIN_BASE_URL}'
+
+ALTCHA_API_KEY = ''
+ALTCHA_SECRET = ''
+
+ALTCHA_SPAMFILTER_ENDPOINT = 'https://eu.altcha.org/api/v1/classify?'

.docker/etc/settings_local.prod.py.example

@@ -28,7 +28,8 @@ DATABASES = {
         'HOST': 'db',
         'PORT': '',
         'OPTIONS': {
-#            "SET character_set_connection=utf8mb3, collation_connection=utf8_unicode_ci",  # Uncomment when using MySQL to ensure consistency across servers
+            'charset': 'utf8mb4',
+            'init_command': "SET NAMES 'utf8mb4' COLLATE 'utf8mb4_general_ci'"
         },
     }
 }
@@ -41,7 +42,7 @@ DATABASES = {
 ###
 CACHES = {
      'default': {
-         'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache',
+         'BACKEND': 'django.core.cache.backends.memcached.PyMemcacheCache',
          'LOCATION': 'memcached:11211',
          'KEY_FUNCTION': 'mainsite.utils.filter_cache_key'
      }
@@ -143,4 +144,25 @@ LOGGING = {
 }
 
 NOUNPROJECT_API_KEY = ''
-NOUNPROJECT_SECRET = ''
+NOUNPROJECT_SECRET = ''
+
+AISKILLS_API_KEY = ''
+AISKILLS_ENDPOINT_CHATS = ''
+AISKILLS_ENDPOINT_KEYWORDS = ''
+
+OIDC_RP_CLIENT_ID = ''
+OIDC_RP_CLIENT_SECRET = ''
+OIDC_OP_AUTHORIZATION_ENDPOINT = ''
+OIDC_OP_TOKEN_ENDPOINT = ''
+OIDC_OP_USER_ENDPOINT = ''
+OIDC_OP_JWKS_ENDPOINT = ''
+OIDC_OP_END_SESSION_ENDPOINT = ''
+LOGIN_BASE_URL = ''
+
+# Don't change these
+LOGIN_REDIRECT_URL = f'{LOGIN_BASE_URL}?validateToken'
+LOGOUT_REDIRECT_URL = f'{LOGIN_BASE_URL}'
+
+ALTCHA_API_KEY = ''
+ALTCHA_SECRET = ''
+ALTCHA_SPAMFILTER_ENDPOINT = "https://eu.altcha.org/api/v1/classify?"

.docker/etc/uwsgi.ini

@@ -7,3 +7,12 @@ threads=2
 chdir=/badgr_server
 module=wsgi:application
 vacuum=true
+gid=999
+uid=999
+
+harakiri = 300 # 5 minutes
+http-timeout = 300 
+socket-timeout = 300 
+
+buffer-size = 8192
+header-buffer-size = 8192 

.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"