feat: included 2FA and lots of feature from django-htmx-template

config/settings/base.py

@@ -10,10 +10,8 @@ For the full list of config and their values, see
 https://docs.djangoproject.com/en/6.0/ref/settings/
 """
 
-from pathlib import Path
 from config.settings.env import *
 
-
 # Application definition
 
 DJANGO_APPS = [
@@ -30,6 +28,9 @@ THIRD_PARTY_APPS = [
     'django_extensions',
     'django_filters',
     'django_htmx',
+    'django_otp',
+    'django_otp.plugins.otp_totp',
+    'django_otp.plugins.otp_static',
     'watchman',
 ]
 
@@ -54,6 +55,7 @@ MIDDLEWARE = [
     'django.middleware.common.CommonMiddleware',
     'django.middleware.csrf.CsrfViewMiddleware',
     'django.contrib.auth.middleware.AuthenticationMiddleware',
+    'django_otp.middleware.OTPMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
     'django.middleware.clickjacking.XFrameOptionsMiddleware',
     'django_htmx.middleware.HtmxMiddleware',
@@ -79,6 +81,7 @@ TEMPLATES = [
                 'django.template.context_processors.request',
                 'django.contrib.auth.context_processors.auth',
                 'django.contrib.messages.context_processors.messages',
+                'crochet.context_processors.site_name',
             ],
         },
     },
@@ -102,6 +105,11 @@ LOGIN_URL = 'crochet:login'
 LOGIN_REDIRECT_URL = 'crochet:home'
 LOGOUT_REDIRECT_URL = 'crochet:login'
 
+# Nombre que muestran apps como Google Authenticator/Aegis junto al usuario
+# al escanear el QR de alta de verificación en dos pasos (ver
+# TOTPDevice.config_url, crochet/views.py).
+OTP_TOTP_ISSUER = SITE_NAME
+
 
 # Password validation
 # https://docs.djangoproject.com/en/6.0/ref/settings/#auth-password-validators
@@ -165,6 +173,15 @@ EMAIL_USE_TLS = True
 EMAIL_USE_SSL = False
 
 
+# Security
+# https://docs.djangoproject.com/en/6.0/topics/security/
+# SECURE_SSL_REDIRECT/SESSION_COOKIE_SECURE/CSRF_COOKIE_SECURE/SECURE_HSTS_*
+# se leen de env.py (ver env.py): desactivados por defecto porque asumen
+# HTTPS, que no hay en desarrollo local. SECURE_CONTENT_TYPE_NOSNIFF no
+# depende de eso (no rompe nada servir por HTTP), así que va fijo aquí.
+SECURE_CONTENT_TYPE_NOSNIFF = True
+
+
 # Logging
 # https://docs.djangoproject.com/en/6.0/topics/logging/