CORS error cleaned

001.BACKEND/core/settings.py

@@ -1,13 +1,5 @@
 """
 Django settings for core project.
-
-Generated by 'django-admin startproject' using Django 6.0.5.
-
-For more information on this file, see
-https://docs.djangoproject.com/en/6.0/topics/settings/
-
-For the full list of settings and their values, see
-https://docs.djangoproject.com/en/6.0/ref/settings/
 """
 
 import os
@@ -20,16 +12,11 @@ BASE_DIR = Path(__file__).resolve().parent.parent
 
 load_dotenv(BASE_DIR / '.env')
 
-# Quick-start development settings - unsuitable for production
-# See https://docs.djangoproject.com/en/6.0/howto/deployment/checklist/
-
-# SECURITY WARNING: keep the secret key used in production secret!
 SECRET_KEY = os.getenv(
     'DJANGO_SECRET_KEY',
     'django-insecure-!228(8gy#3a7l-@_^g1s4bipj&@*+_415+ulx0^-9jw(%ksdvy',
 )
 
-# SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = os.getenv('DJANGO_DEBUG', 'True').lower() in ('1', 'true', 'yes', 'on')
 
 # Custom user model
@@ -42,7 +29,6 @@ ALLOWED_HOSTS = [
 ]
 
 # Application definition
-
 INSTALLED_APPS = [
     'django.contrib.admin',
     'django.contrib.auth',
@@ -93,10 +79,6 @@ TEMPLATES = [
 
 WSGI_APPLICATION = 'core.wsgi.application'
 
-
-# Database
-# https://docs.djangoproject.com/en/6.0/ref/settings/#databases
-
 DATABASES = {
     'default': {
         'ENGINE': 'django.db.backends.sqlite3',
@@ -104,93 +86,56 @@ DATABASES = {
     }
 }
 
-
-# Password validation
-# https://docs.djangoproject.com/en/6.0/ref/settings/#auth-password-validators
-
 AUTH_PASSWORD_VALIDATORS = [
-    {
-        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
-    },
-    {
-        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
-    },
-    {
-        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
-    },
-    {
-        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
-    },
+    { 'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator' },
+    { 'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator' },
+    { 'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator' },
+    { 'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator' },
 ]
 
-
-# Internationalization
-# https://docs.djangoproject.com/en/6.0/topics/i18n/
-
 LANGUAGE_CODE = 'en-us'
-
 TIME_ZONE = 'Europe/Zagreb'
-
 USE_I18N = True
-
 USE_TZ = True
 
-
-# Static files (CSS, JavaScript, Images)
-# https://docs.djangoproject.com/en/6.0/howto/static-files/
-
 STATIC_URL = 'static/'
 STATIC_ROOT = os.path.join(BASE_DIR, 'staticfiles')
 
-
-# Automatski koristi filtriranje na svim API endpointima koji podržavaju filtriranje
-
 if DEBUG:
-    # Razvojni način: Svatko može čitati i pisati bez tokena
-    DEFAULT_PERMISSION_CLASSES = [
-        'rest_framework.permissions.AllowAny',
-    ]
+    DEFAULT_PERMISSION_CLASSES = [ 'rest_framework.permissions.AllowAny' ]
 else:
-    # Produkcijski način: Pristup samo uz ispravan JWT token
-    DEFAULT_PERMISSION_CLASSES = [
-        'rest_framework.permissions.IsAuthenticated',
-    ]
+    DEFAULT_PERMISSION_CLASSES = [ 'rest_framework.permissions.IsAuthenticated' ]
 
 REST_FRAMEWORK = {
     'DEFAULT_FILTER_BACKENDS': [
         'django_filters.rest_framework.DjangoFilterBackend'
     ],
-    # JWT Autentikacija
     'DEFAULT_AUTHENTICATION_CLASSES': (
         'rest_framework_simplejwt.authentication.JWTAuthentication',
     ),
-    # Postavi da su po defaultu svi API-ji zaključani (samo za prijavljene)
     'DEFAULT_PERMISSION_CLASSES': DEFAULT_PERMISSION_CLASSES
 }
 
-
-# Podesiti koliko dugo vrijede JWT tokeni (npr. 1 sat za pristup, 30 dana za refresh)
 SIMPLE_JWT = {
     'ACCESS_TOKEN_LIFETIME': timedelta(minutes=60),
     'REFRESH_TOKEN_LIFETIME': timedelta(days=30),
     'AUTH_HEADER_TYPES': ('Bearer',),
 }
 
-# Media files (npr. slike vozila)
-
 MEDIA_URL = '/media/'
 MEDIA_ROOT = os.path.join(BASE_DIR, 'media')
 
-
-# CORS postavke - dozvoli frontend aplikaciji da komunicira s backendom
-
+# CORS POSTAVKE - POPRAVLJENI ZAREZI I FORMALNI ORIGINI
 if DEBUG:
     CORS_ALLOW_ALL_ORIGINS = True
 else:
+    CORS_ALLOW_ALL_ORIGINS = False
     CORS_ALLOWED_ORIGINS = [
-        "http://localhost:4321", # Ovo je adresa na kojoj će Astro frontend biti dostupan
-        "http://127.0.0.1:4321",
+        host.strip()
+        for host in os.getenv('DJANGO_CORS_ALLOWED_ORIGINS', '').split(',')
+        if host.strip()
     ]
+
 CORS_ALLOW_METHODS = [
     "DELETE",
     "GET",
@@ -201,10 +146,19 @@ CORS_ALLOW_METHODS = [
 ]
 
 CORS_ALLOW_HEADERS = [
-    "accept",
-    "authorization",
-    "content-type",
-    "user-agent",
-    "x-csrftoken",
-    "x-requested-with",
-]
+    'accept',
+    'accept-encoding',
+    'authorization',
+    'content-type',
+    'dnt',
+    'origin',
+    'user-agent',
+    'x-csrftoken',
+    'x-requested-with',
+    'access-control-request-private-network',
+]
+
+# Ako preglednik pošalje PNA preflight zahtjev sa lokalne mreže, 
+# corsheaders će ga s ovim u potpunosti odobriti bez redirecta
+CORS_ALLOW_PRIVATE_NETWORK = True
+CORS_PREFLIGHT_MAX_AGE = 86400