（四）配置与请求中间件
1. 按请求经过的位置认识设置
# 项目文件：reading_project/src/reading_site/settings.py
import os
from pathlib import Path
from .runtime import persistent_key
BASE_DIR = Path(__file__).resolve().parents[2]
INSTANCE_DIR = Path(os.getenv("READING_INSTANCE", str(BASE_DIR / "instance"))).resolve()
INSTANCE_DIR.mkdir(parents=True, exist_ok=True)
SECRET_KEY = os.getenv("READING_SECRET_KEY") or persistent_key(INSTANCE_DIR)
DEBUG = True # 本机调试；部署设置在独立模块中覆盖。
ALLOWED_HOSTS = ["127.0.0.1", "localhost", "testserver"]
ROOT_URLCONF = "reading_site.urls"
WSGI_APPLICATION = "reading_site.wsgi.application"
ASGI_APPLICATION = "reading_site.asgi.application"
INSTALLED_APPS = [
"django.contrib.admin",
"django.contrib.auth",
"django.contrib.contenttypes",
"django.contrib.sessions",
"django.contrib.messages",
"django.contrib.staticfiles",
"library.apps.LibraryConfig",
]
MIDDLEWARE = [
"django.middleware.security.SecurityMiddleware",
"django.contrib.sessions.middleware.SessionMiddleware",
"django.middleware.common.CommonMiddleware",
"django.middleware.csrf.CsrfViewMiddleware",
"django.contrib.auth.middleware.AuthenticationMiddleware",
"django.contrib.messages.middleware.MessageMiddleware",
"django.middleware.clickjacking.XFrameOptionsMiddleware",
]INSTALLED_APPS 登记用户、会话、后台、静态文件以及阅读功能。MIDDLEWARE 在请求进入视图和响应返回时执行公共处理：会话中间件先恢复会话，认证中间件再提供 request.user；CSRF 中间件负责写入请求的来源与令牌检查。
INSTANCE_DIR 保存本机数据与密钥，READING_INSTANCE 可以改换位置。persistent_key 沿用上一章完整写入、发布名称并保留已有密钥的流程，见 runtime.py。默认调试配置允许本机地址，部署配置另行覆盖。
# 续写同一文件：reading_project/src/reading_site/settings.py
# 数据库、模板和会话共同读取当前实例与已登记应用。
DATABASES = {
"default": {
"ENGINE": "django.db.backends.sqlite3",
"NAME": INSTANCE_DIR / "reading.sqlite3",
}
}
TEMPLATES = [
{
"BACKEND": "django.template.backends.django.DjangoTemplates",
"DIRS": [],
"APP_DIRS": True,
"OPTIONS": {
"context_processors": [
"django.template.context_processors.request",
"django.contrib.auth.context_processors.auth",
"django.contrib.messages.context_processors.messages",
]
},
}
]
AUTH_PASSWORD_VALIDATORS = [
{
"NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator"
},
{"NAME": "django.contrib.auth.password_validation.MinimumLengthValidator"},
{"NAME": "django.contrib.auth.password_validation.CommonPasswordValidator"},
{"NAME": "django.contrib.auth.password_validation.NumericPasswordValidator"},
]
LANGUAGE_CODE, TIME_ZONE = "zh-hans", "Asia/Shanghai"
USE_I18N = USE_TZ = True
DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
LOGIN_URL, LOGIN_REDIRECT_URL, LOGOUT_REDIRECT_URL = "login", "library:index", "login"
SESSION_ENGINE = "django.contrib.sessions.backends.db"
SESSION_COOKIE_NAME, CSRF_COOKIE_NAME = "reading_session", "reading_csrf"
SESSION_COOKIE_AGE = 3600
STATIC_URL = "/static/"
STATIC_ROOT = INSTANCE_DIR / "staticfiles"DATABASES 告诉 ORM 使用哪份 SQLite 文件；TEMPLATES 使用 Django 模板引擎，并从已登记应用中找模板。上下文处理器把请求、用户权限和消息放入模板可用数据。USE_TZ=True 让数据库时间按时区规则处理，再按 Asia/Shanghai 显示。
这里的配置是 Python 模块，不是请求中的可变字典；启动时加载。SESSION_ENGINE 明确采用数据库会话，稍后与 Flask 的签名 Cookie 作实际对照。
