start project

backend/config/settings/base.py

@@ -64,6 +64,9 @@ INSTALLED_APPS = [
     "django_filters",
     "corsheaders",
     "drf_spectacular",
+    # Serves the Swagger UI / ReDoc bundles from our own origin instead of a
+    # CDN, which is what keeps the strict CSP in frontend/nginx.conf working.
+    "drf_spectacular_sidecar",
     # Local
     "apps.core",
     "apps.accounts",
@@ -212,8 +215,21 @@ SPECTACULAR_SETTINGS = {
     "COMPONENT_SPLIT_REQUEST": True,
     "SCHEMA_PATH_PREFIX": "/api/v1",
     "SERVE_PERMISSIONS": ["rest_framework.permissions.AllowAny"],
+    # Serve the UI assets from this origin (drf-spectacular-sidecar) rather
+    # than the default cdn.jsdelivr.net "@latest" URLs: the CSP blocks
+    # third-party scripts, so the CDN version renders a blank page.
+    "SWAGGER_UI_DIST": "SIDECAR",
+    "SWAGGER_UI_FAVICON_HREF": "SIDECAR",
+    "REDOC_DIST": "SIDECAR",
 }
 
+# Whether /api/docs/, /api/redoc/ and /api/schema/ are routed at all.  They
+# describe every endpoint, parameter and response shape in the service, so
+# production keeps them off by default and opts in explicitly (behind an
+# authenticating proxy) rather than publishing the full API surface to
+# anonymous callers - see config/urls.py.
+SERVE_API_DOCS = env.bool("SERVE_API_DOCS", default=True)
+
 # ---------------------------------------------------------------------------
 # CORS / CSRF
 # ---------------------------------------------------------------------------