invenio.cfg

"""
InvenioRDM settings for CDS-RDM project.

This file was automatically generated by 'invenio-cli init'.

For the full list of settings and their values, see
https://inveniordm.docs.cern.ch/reference/configuration/.
"""

import os

from copy import deepcopy
from datetime import datetime, timedelta
from invenio_i18n import lazy_gettext as _

from cds_rdm import schemes
from cds_rdm.permissions import (
    CDSCommunitiesPermissionPolicy,
    CDSRDMRecordPermissionPolicy,
    CDSRDMPreservationSyncPermissionPolicy,
)
from cds_rdm.files import storage_factory
from celery.schedules import crontab
from invenio_app_rdm.config import STATS_EVENTS as _APP_RDM_STATS_EVENTS
from invenio_vocabularies.services.custom_fields import VocabularyCF
from invenio_records_resources.services.custom_fields import KeywordCF
from invenio_rdm_records.config import (
    RDM_RECORDS_IDENTIFIERS_SCHEMES, always_valid, RDM_RECORDS_PERSONORG_SCHEMES,
    RDM_PERSISTENT_IDENTIFIERS, RDM_PARENT_PERSISTENT_IDENTIFIERS
)
from invenio_rdm_records.proxies import current_rdm_records_service as record_service
from invenio_rdm_records.config import (
    RDM_PERSISTENT_IDENTIFIERS,
    RDM_PARENT_PERSISTENT_IDENTIFIERS,
    RDM_SEARCH
)
from invenio_preservation_sync.utils import preservation_info_render
from invenio_cern_sync.users.profile import CERNUserProfileSchema
from invenio_oauthclient.views.client import auto_redirect_login
from invenio_cern_sync.sso import cern_remote_app_name, cern_keycloak

from invenio_rdm_records.config import RDM_PERSISTENT_IDENTIFIERS, RDM_PARENT_PERSISTENT_IDENTIFIERS
from invenio_vocabularies.config import VOCABULARIES_NAMES_SCHEMES as DEFAULT_VOCABULARIES_NAMES_SCHEMES

def _(x):  # needed to avoid start time failure with lazy strings
    return x


# Flask
# =====
# See https://flask.palletsprojects.com/en/1.1.x/config/

# Define the value of the cache control header `max-age` returned by the server when serving
# public files. Files will be cached by the browser for the provided number of seconds.
# See flask documentation for more information:
# https://flask.palletsprojects.com/en/2.1.x/config/#SEND_FILE_MAX_AGE_DEFAULT
SEND_FILE_MAX_AGE_DEFAULT = 300

# SECURITY WARNING: keep the secret key used in production secret!
# Do not commit it to a source code repository.
# TODO: Set
SECRET_KEY = "CHANGE_ME"

# Since HAProxy and Nginx route all requests no matter the host header
# provided, the allowed hosts variable is set to localhost. In production it
# should be set to the correct host and it is strongly recommended to only
# route correct hosts to the application.
APP_ALLOWED_HOSTS = ['0.0.0.0', 'localhost', '127.0.0.1', 'localhost.cern.ch']

# Flask-SQLAlchemy
# ================
# See https://flask-sqlalchemy.palletsprojects.com/en/2.x/config/

# TODO: Set
SQLALCHEMY_DATABASE_URI = "postgresql+psycopg2://cds-rdm:cds-rdm@localhost/cds-rdm"

# Invenio-App
# ===========
# See https://invenio-app.readthedocs.io/en/latest/configuration.html

APP_DEFAULT_SECURE_HEADERS = {
    'content_security_policy': {
        'default-src': [
            "'self'",
            'data:',  # for fonts
            "'unsafe-inline'",  # for inline scripts and styles
            "blob:",  # for pdf preview
            "cdnjs.cloudflare.com",
            # For CERN Matomo
            "webanalytics.web.cern.ch",
            "test-matomo-wf.web.cern.ch",
        ],
    },
    'content_security_policy_report_only': False,
    'content_security_policy_report_uri': None,
    'force_file_save': False,
    'force_https': True,
    'force_https_permanent': False,
    'frame_options': 'sameorigin',
    'frame_options_allow_from': None,
    'session_cookie_http_only': True,
    'session_cookie_secure': True,
    'strict_transport_security': True,
    'strict_transport_security_include_subdomains': True,
    'strict_transport_security_max_age': 31556926,  # One year in seconds
    'strict_transport_security_preload': False,
}

# Flask-Babel
# ===========
# See https://python-babel.github.io/flask-babel/#configuration

# Default locale (language)
BABEL_DEFAULT_LOCALE = 'en'
# Default time zone
BABEL_DEFAULT_TIMEZONE = 'Europe/Zurich'

# Invenio-I18N
# ============
# See https://invenio-i18n.readthedocs.io/en/latest/configuration.html

# Other supported languages (do not include BABEL_DEFAULT_LOCALE in list).
I18N_LANGUAGES = [
    # ('de', _('German')),
    # ('tr', _('Turkish')),
]

# Invenio-Theme
# =============
# See https://invenio-theme.readthedocs.io/en/latest/configuration.html

# Frontpage title
THEME_FRONTPAGE_TITLE = "CERN Document Server"
# Header logo
THEME_LOGO = 'images/invenio-rdm.svg'
THEME_SHOW_FRONTPAGE_INTRO_SECTION = False

THEME_SITENAME = 'CDS'
# Templates
# THEME_FRONTPAGE_TEMPLATE = 'cds_rdm/frontpage.html'
# THEME_FOOTER_TEMPLATE = 'cds_rdm/footer.html'
# THEME_HEADER_TEMPLATE = 'cds_rdm/header.html'

# Site tracking code template for matomo analytics
# Enable the below on the dedicated environment
THEME_TRACKINGCODE_TEMPLATE = "cds_rdm/matomo-test.html"

# Invenio-App-RDM
# ===============
# See https://invenio-app-rdm.readthedocs.io/en/latest/configuration.html

# Instance's theme entrypoint file. Path relative to the ``assets/`` folder.
INSTANCE_THEME_FILE = './less/theme.less'

# Invenio-communities
# ===================
# Communities permission policy
COMMUNITIES_PERMISSION_POLICY = CDSCommunitiesPermissionPolicy
COMMUNITIES_ADMINISTRATION_DISABLED = False
COMMUNITIES_ALLOW_RESTRICTED = True
COMMUNITIES_RECORDS_SEARCH = deepcopy(RDM_SEARCH)


# Invenio-Records-Resources
# =========================
# See https://github.com/inveniosoftware/invenio-records-resources/blob/master/invenio_records_resources/config.py

# TODO: Set with your own hostname when deploying to production
SITE_UI_URL = "https://127.0.0.1"

SITE_API_URL = "https://127.0.0.1/api"

APP_RDM_DEPOSIT_FORM_DEFAULTS = {
    "publication_date": lambda: datetime.now().strftime("%Y-%m-%d"),
    "rights": [
        {
            "id": "cc-by-4.0",
            "title": "Creative Commons Attribution 4.0 International",
            "description": ("The Creative Commons Attribution license allows "
                            "re-distribution and re-use of a licensed work "
                            "on the condition that the creator is "
                            "appropriately credited."),
            "link": "https://creativecommons.org/licenses/by/4.0/legalcode",
        }
    ],
    "publisher": "CERN",
}

# See https://github.com/inveniosoftware/invenio-app-rdm/blob/master/invenio_app_rdm/config.py
APP_RDM_DEPOSIT_FORM_AUTOCOMPLETE_NAMES = 'search'  # "search_only" or "off"

# Invenio-RDM-Records
# ===================
# See https://inveniordm.docs.cern.ch/customize/dois/
DATACITE_ENABLED = True
DATACITE_USERNAME = ""
DATACITE_PASSWORD = ""
DATACITE_PREFIX = ""
DATACITE_TEST_MODE = True
DATACITE_DATACENTER_SYMBOL = ""

RDM_PERSISTENT_IDENTIFIERS["doi"]["required"] = False
RDM_PERSISTENT_IDENTIFIERS["doi"]["ui"]["default_selected"] = "not_needed"  # "yes", "no" or "not_needed"
RDM_PARENT_PERSISTENT_IDENTIFIERS["doi"]["required"] = False

# Authentication - Invenio-Accounts and Invenio-OAuthclient
# =========================================================
# See: https://inveniordm.docs.cern.ch/customize/authentication/

# Invenio-Accounts
# ================
# See https://github.com/inveniosoftware/invenio-accounts/blob/master/invenio_accounts/config.py
ACCOUNTS_DEFAULT_USERS_VERIFIED = True  # ensure that users are verified by default
ACCOUNTS_DEFAULT_USER_VISIBILITY = "public"  # enables users to be searchable for invites
ACCOUNTS_DEFAULT_EMAIL_VISIBILITY = "public"
ACCOUNTS_LOCAL_LOGIN_ENABLED = True  # enable local login
PERMANENT_SESSION_LIFETIME = timedelta(days=10)
SECURITY_REGISTERABLE = True  # local login: allow users to register
SECURITY_RECOVERABLE = False  # local login: allow users to reset the password
SECURITY_CHANGEABLE = False  # local login: allow users to change psw
SECURITY_CONFIRMABLE = False  # local login: users can confirm e-mail address
SECURITY_LOGIN_WITHOUT_CONFIRMATION = True  # require users to confirm email before being able to login

# Emails sending
# Disable sending all account-related emails because of CERN SSO usage
SECURITY_SEND_PASSWORD_CHANGE_EMAIL = False
SECURITY_SEND_PASSWORD_RESET_EMAIL = False
SECURITY_SEND_PASSWORD_RESET_NOTICE_EMAIL = False
SECURITY_SEND_REGISTER_EMAIL = False

# Invenio-CERN-Sync/CERN SSO
# ==========================
OAUTHCLIENT_REMOTE_APPS = {
    cern_remote_app_name: cern_keycloak.remote_app,
}

CERN_APP_CREDENTIALS = {
    "consumer_key": "CHANGE ME",
    "consumer_secret": "CHANGE ME",
}
CERN_SYNC_KEYCLOAK_BASE_URL = "https://auth.cern.ch/"
CERN_SYNC_AUTHZ_BASE_URL = "https://authorization-service-api.web.cern.ch/"
INVENIO_CERN_SYNC_KEYCLOAK_BASE_URL = "https://auth.cern.ch/"  # set env var when testing

OAUTHCLIENT_CERN_REALM_URL = cern_keycloak.realm_url
OAUTHCLIENT_CERN_USER_INFO_URL = cern_keycloak.user_info_url
OAUTHCLIENT_CERN_VERIFY_EXP = True
OAUTHCLIENT_CERN_VERIFY_AUD = False
OAUTHCLIENT_CERN_USER_INFO_FROM_ENDPOINT = True

ACCOUNTS_LOGIN_VIEW_FUNCTION = auto_redirect_login  # autoredirect to external login if enabled
OAUTHCLIENT_AUTO_REDIRECT_TO_EXTERNAL_LOGIN = True  # autoredirect to external login

ACCOUNTS_USER_PROFILE_SCHEMA = CERNUserProfileSchema()

# Invenio-UserProfiles
# ====================
USERPROFILES_READ_ONLY = True  # disable change of user profile
USERPROFILES_EXTEND_SECURITY_FORMS = True  # automatically use user's email address as account email

# OAI-PMH
# =======
OAISERVER_ID_PREFIX = "cds-rdm.com"
"""The prefix that will be applied to the generated OAI-PMH ids."""

# Invenio-Search
# ==============
SEARCH_INDEX_PREFIX = "cds-rdm-"

###############################################################################
# CDS-RDM configuration
###############################################################################
CDS_SERVICE_ELEMENT_URL = "https://cern.service-now.com/service-portal?id=service_element&name=CDS-Service"

# Permissions: define who can create new communities
CDS_EMAILS_ALLOW_CREATE_COMMUNITIES = []
CDS_GROUPS_ALLOW_CREATE_COMMUNITIES = []

# Invenio-Files-REST
# ==================
XROOTD_ENABLED = False
# control file download offloading
FILES_REST_STORAGE_FACTORY = storage_factory
FILES_REST_XSENDFILE_ENABLED = False
CDS_EOS_OFFLOAD_ENABLED = False
CDS_LOCAL_OFFLOAD_ENABLED = False
CDS_LOCAL_OFFLOAD_FILES = ["file.txt", "file2.txt"]
CDS_LOCAL_OFFLOAD_STORAGE = ""

CDS_EOS_OFFLOAD_HTTPHOST = ""
# Specifies whether to use X509 authentication for EOS offload
CDS_EOS_OFFLOAD_AUTH_X509 = False
# The path to the X509 certificate file
CDS_EOS_OFFLOAD_X509_CERT_PATH = ""
# The path to the X509 private key file
CDS_EOS_OFFLOAD_X509_KEY_PATH = ""
# check nginx config for more details
CDS_EOS_OFFLOAD_REDIRECT_BASE_PATH = ""

# CDS Migration
CDS_REDIRECTION_COLLECTIONS_MAPPING = {
    "CERN Students Projects": "",  # uuid
}

RDM_PERMISSION_POLICY = CDSRDMRecordPermissionPolicy

# Static pages
APP_RDM_PAGES = {
    "about": "/about",
    "privacy-notice": "/privacy-notice",
    "terms": "/terms",
    "content-policy": "/content-policy",
    "preservation-policy": "/preservation-policy",
}

# Custom fields
RDM_NAMESPACES = {
    # CERN
    "cern": "https://greybook.cern.ch/"
}

RDM_CUSTOM_FIELDS = [
    VocabularyCF(
        name="cern:experiments",
        vocabulary_id="experiments",
        dump_options=True,
        multiple=True,
    ),
    VocabularyCF(
        name="cern:departments",
        vocabulary_id="departments",
        dump_options=True,
        multiple=True,
    ),
    VocabularyCF(
        name="cern:accelerators",
        vocabulary_id="accelerators",
        dump_options=True,
        multiple=True,
    ),
    KeywordCF(name="cern:projects", multiple=True),
    KeywordCF(name="cern:facilities", multiple=True),
    KeywordCF(name="cern:studies", multiple=True),
    VocabularyCF(
        name="cern:beams",
        vocabulary_id="beams",
        dump_options=True,
        multiple=True,
    )
]
# Require files for user upload
RDM_ALLOW_METADATA_ONLY_RECORDS = False

THEME_MATHJAX_CDN = (
    "//cdnjs.cloudflare.com/ajax/libs/mathjax/3.2.2/es5/tex-mml-chtml.js"
    "?config=TeX-AMS-MML_HTMLorMML"
)

RDM_CUSTOM_FIELDS_UI = [
    {
        "section": "Organization",
        "displaySection": False,
        "fields": [
            dict(
                field="cern:departments",
                ui_widget="Dropdown",
                display_url="https://scientific-info.cern/archives/history_CERN/internal_organisation/20s",
                props=dict(
                    label="Department",
                    icon="building",
                    description="Please select a recognised department from the list if applicable e.g BE, EN, HR etc.",
                    search=False,
                    multiple=True,
                    sort_by="title_sort",
                    clearable=True,
                    autocompleteFrom="/api/vocabularies/departments",
                )
            )
        ]
    },
    {
        "section": "Accelerators and Beams",
        "discoverable_fields": True,  # marks the section with discoverable fields
        "fields": [
            dict(
                field="cern:accelerators",
                ui_widget="Dropdown",
                display_url="https://scientific-info.cern/archives/history_CERN/internal_organisation/20s",
                props=dict(
                    label="Accelerator",
                    icon="bullseye",
                    description="Please select a recognised accelerator from the list if applicable e.g LHC, SPS, PS, R&D etc.",
                    search=False,
                    multiple=True,
                    sort_by="title_sort",
                    clearable=True,
                    type="text",
                    multiple_values=True,
                    autocompleteFrom="/api/vocabularies/accelerators",
                    note=_(
                        "The specific accelerator of the data record, e.g LHC, SPS, PS, R&D etc."
                    ),
                )
            ),
            dict(
                field="cern:beams",
                ui_widget="Dropdown",
                props=dict(
                    label="Beam",
                    icon="bullseye",
                    description="Please select a recognised beam from the list if applicable e.g H4, X7, T9 etc.",
                    search=False,
                    multiple=True,
                    sort_by="title_sort",
                    clearable=True,
                    type="text",
                    multiple_values=True,
                    autocompleteFrom="/api/vocabularies/beams",
                    note=_(
                        "The specific beam of the data record, e.g., H4."
                    ),
                )
            )
        ]
    },
    {
        "section": "Research activities",
        "discoverable_fields": True,  # marks the section with discoverable fields
        "fields": [
            dict(
                field="cern:experiments",
                ui_widget="AutocompleteDropdown",
                display_url="https://greybook.cern.ch/experiment/list",
                props=dict(
                    label="Experiment",
                    icon="lab",
                    placeholder="Select an experiment",
                    description="You should fill this field with one of the experiments e.g ATLAS, CMS, LHCb etc.",
                    search=True,
                    multiple=True,
                    clearable=True,
                    autocompleteFrom="/api/vocabularies/experiments",
                    note=_(
                        "The specific experiment of the data record, e.g. ATLAS, CMS, LHCb etc."
                    ),
                    type="text",
                    multiple_values=True,
                )
            ),
            dict(
                field="cern:projects",
                ui_widget="MultiInput",
                props=dict(
                    label=_("Projects"),
                    type="text",
                    description="You should fill this field with one of the projects e.g HL-LHC, HIE-ISOLDE etc.",
                    multiple_values=True,
                    note=_(
                        "The specific project of the data record, e.g HL-LHC, HIE-ISOLDE etc."
                    ),
                ),
            ),
            dict(
                field="cern:studies",
                ui_widget="MultiInput",
                props=dict(
                    label=_("Studies"),
                    type="text",
                    description="You should fill this field with one of the studies e.g CLICdp, VHE-LHC etc.",
                    multiple_values=True,
                    note=_(
                        "The specific study of the data record, e.g CLICdp, VHE-LHC etc."
                    ),
                ),
            ),
            dict(
                field="cern:facilities",
                ui_widget="MultiInput",
                props=dict(
                    label=_("Facilities"),
                    type="text",
                    description="You should fill this field with one of the research facilities e.g ISOLDE, HiRadMat etc.",
                    multiple_values=True,
                    note=_(
                        "The specific facility beam of the data record, e.g ISOLDE, HiRadMat etc."
                    ),
                ),
            )
        ]
    }
]
RDM_FILES_DEFAULT_QUOTA_SIZE = 50 * 10 ** 9  # 50GB
RDM_FILES_DEFAULT_MAX_FILE_SIZE = 50 * 10 ** 9  # 50GB

JOBS_ADMINISTRATION_ENABLED = True

RDM_RECORDS_IDENTIFIERS_SCHEMES = {**RDM_RECORDS_IDENTIFIERS_SCHEMES,
                                   **{"cds_ref": {"label": _("CDS Reference"),
                                                  "validator": always_valid,
                                                  "datacite": "CDS"},
                                      "aleph": {"label": _("Aleph number"),
                                                "validator": schemes.is_aleph,
                                                "datacite": "ALEPH"},
                                      "inspire": {"label": _("Inspire"),
                                                  "validator": schemes.is_inspire,
                                                  "datacite": "INSPIRE"}}}

RDM_RECORDS_PERSONORG_SCHEMES = {**RDM_RECORDS_PERSONORG_SCHEMES,
                                 **{"inspire": {"label": _("Inspire"),
                                                "validator": schemes.is_inspire_author,
                                                "datacite": "INSPIRE"},
                                    "lcds": {"label": _("CDS"),
                                             "validator": schemes.is_legacy_cds,
                                             "datacite": "CDS"}
                                    }
                                 }

### Do not require DOIs for record and parent
RDM_PERSISTENT_IDENTIFIERS["doi"]["required"] = False
RDM_PARENT_PERSISTENT_IDENTIFIERS["doi"]["required"] = False
RDM_PERSISTENT_IDENTIFIERS["doi"]["ui"]["default_selected"] = "not_needed"  # "yes", "no" or "not_needed"
# Invenio-Preservation-Sync
# =========================

PRESERVATION_SYNC_ENABLED = True


def resolve_record_pid(pid):
    return record_service.record_cls.pid.resolve(pid).id


PRESERVATION_SYNC_PID_RESOLVER = resolve_record_pid

PRESERVATION_SYNC_PERMISSION_POLICY = CDSRDMPreservationSyncPermissionPolicy

PRESERVATION_SYNC_GET_LIST_PATH = "/records/<pid_id>/preservations"

PRESERVATION_SYNC_GET_LATEST_PATH = "/records/<pid_id>/preservations/latest"

PRESERVATION_SYNC_UI_TITLE = "CERN Digital Memory"

PRESERVATION_SYNC_UI_INFO_LINK = "/preservation-policy"

PRESERVATION_SYNC_UI_ICON_PATH = "images/dm_logo.png"

APP_RDM_RECORD_LANDING_PAGE_EXTERNAL_LINKS = [
    {"id": "preservation", "render": preservation_info_render},
]
VOCABULARIES_NAMES_SCHEMES = {
    **DEFAULT_VOCABULARIES_NAMES_SCHEMES,
    "inspire": {"label": _("Inspire"),
                "validator": schemes.is_inspire_author,
                "datacite": "INSPIRE"},
    "lcds": {"label": _("CDS"), "validator": schemes.is_legacy_cds, "datacite": "CDS"},
}
"""Names allowed identifier schemes."""


# Invenio Stats
# =============

# We override the templates to add new fields needed for the migrated statistic events
_APP_RDM_STATS_EVENTS["file-download"]["templates"] = "cds_rdm.stats.templates.events.file_download"
_APP_RDM_STATS_EVENTS["record-view"]["templates"] = "cds_rdm.stats.templates.events.record_view"