feat: Implement avatar upload system with Cloudflare integration

- Added migration to transition avatar data from CloudflareImageField to ForeignKey structure in UserProfile.
- Fixed UserProfileEvent avatar field to align with new avatar structure.
- Created serializers for social authentication, including connected and available providers.
- Developed request logging middleware for comprehensive request/response logging.
- Updated moderation and parks migrations to remove outdated triggers and adjust foreign key relationships.
- Enhanced rides migrations to ensure proper handling of image uploads and triggers.
- Introduced a test script for the 3-step avatar upload process, ensuring functionality with Cloudflare.
- Documented the fix for avatar upload issues, detailing root cause, implementation, and verification steps.
- Implemented automatic deletion of Cloudflare images upon avatar, park, and ride photo changes or removals.

backend/apps/api/v1/auth/serializers.py

@@ -96,8 +96,8 @@ class UserOutputSerializer(serializers.ModelSerializer):
     @extend_schema_field(serializers.URLField(allow_null=True))
     def get_avatar_url(self, obj) -> str | None:
         """Get user avatar URL."""
-        if hasattr(obj, "profile") and obj.profile.avatar:
-            return obj.profile.avatar.url
+        if hasattr(obj, "profile") and obj.profile:
+            return obj.profile.get_avatar_url()
         return None
 
 
@@ -185,25 +185,92 @@ class SignupInputSerializer(serializers.ModelSerializer):
         return attrs
 
     def create(self, validated_data):
-        """Create user with validated data."""
+        """Create user with validated data and send verification email."""
         validated_data.pop("password_confirm", None)
         password = validated_data.pop("password")
 
-        # Use type: ignore for Django's create_user method which isn't properly typed
+        # Create inactive user - they need to verify email first
         user = UserModel.objects.create_user(  # type: ignore[attr-defined]
-            password=password, **validated_data
+            password=password, is_active=False, **validated_data
         )
 
+        # Create email verification record and send email
+        self._send_verification_email(user)
+
         return user
 
+    def _send_verification_email(self, user):
+        """Send email verification to the user."""
+        from apps.accounts.models import EmailVerification
+        from django.utils.crypto import get_random_string
+        from django_forwardemail.services import EmailService
+        from django.contrib.sites.shortcuts import get_current_site
+        import logging
+
+        logger = logging.getLogger(__name__)
+
+        # Create or update email verification record
+        verification, created = EmailVerification.objects.get_or_create(
+            user=user,
+            defaults={'token': get_random_string(64)}
+        )
+
+        if not created:
+            # Update existing token and timestamp
+            verification.token = get_random_string(64)
+            verification.save()
+
+        # Get current site from request context
+        request = self.context.get('request')
+        if request:
+            site = get_current_site(request._request)
+
+            # Build verification URL
+            verification_url = request.build_absolute_uri(
+                f"/api/v1/auth/verify-email/{verification.token}/"
+            )
+
+            # Send verification email
+            try:
+                response = EmailService.send_email(
+                    to=user.email,
+                    subject="Verify your ThrillWiki account",
+                    text=f"""
+Welcome to ThrillWiki!
+
+Please verify your email address by clicking the link below:
+{verification_url}
+
+If you didn't create an account, you can safely ignore this email.
+
+Thanks,
+The ThrillWiki Team
+                    """.strip(),
+                    site=site,
+                )
+
+                # Log the ForwardEmail email ID from the response
+                email_id = response.get('id') if response else None
+                if email_id:
+                    logger.info(
+                        f"Verification email sent successfully to {user.email}. ForwardEmail ID: {email_id}")
+                else:
+                    logger.info(
+                        f"Verification email sent successfully to {user.email}. No email ID in response.")
+
+            except Exception as e:
+                # Log the error but don't fail registration
+                logger.error(f"Failed to send verification email to {user.email}: {e}")
+
 
 class SignupOutputSerializer(serializers.Serializer):
     """Output serializer for successful signup."""
 
-    access = serializers.CharField()
-    refresh = serializers.CharField()
+    access = serializers.CharField(allow_null=True)
+    refresh = serializers.CharField(allow_null=True)
     user = UserOutputSerializer()
     message = serializers.CharField()
+    email_verification_required = serializers.BooleanField(default=False)
 
 
 class PasswordResetInputSerializer(serializers.Serializer):
@@ -375,7 +442,7 @@ class UserProfileOutputSerializer(serializers.Serializer):
 
     @extend_schema_field(serializers.URLField(allow_null=True))
     def get_avatar_url(self, obj) -> str | None:
-        return obj.get_avatar()
+        return obj.get_avatar_url()
 
     @extend_schema_field(serializers.DictField())
     def get_user(self, obj) -> Dict[str, Any]:

backend/apps/api/v1/auth/serializers_package/__init__.py

@@ -1,8 +1,8 @@
 """
 Auth Serializers Package
 
-This package contains all authentication-related serializers including
-login, signup, logout, password management, and social authentication.
+This package contains social authentication-related serializers.
+Main authentication serializers are imported directly from the parent serializers.py file.
 """
 
 from .social import (
@@ -18,6 +18,7 @@ from .social import (
 )
 
 __all__ = [
+    # Social authentication serializers
     'ConnectedProviderSerializer',
     'AvailableProviderSerializer',
     'SocialAuthStatusSerializer',

backend/apps/api/v1/auth/serializers_package/social.py

@@ -7,7 +7,6 @@ and responses in the ThrillWiki API.
 
 from rest_framework import serializers
 from django.contrib.auth import get_user_model
-from typing import Dict, List
 
 User = get_user_model()
 

backend/apps/api/v1/auth/urls.py

@@ -16,6 +16,9 @@ from .views import (
     PasswordChangeAPIView,
     SocialProvidersAPIView,
     AuthStatusAPIView,
+    # Email verification views
+    EmailVerificationAPIView,
+    ResendVerificationAPIView,
     # Social provider management views
     AvailableProvidersAPIView,
     ConnectedProvidersAPIView,
@@ -83,6 +86,18 @@ urlpatterns = [
     ),
 
     path("status/", AuthStatusAPIView.as_view(), name="auth-status"),
+
+    # Email verification endpoints
+    path(
+        "verify-email/<str:token>/",
+        EmailVerificationAPIView.as_view(),
+        name="auth-verify-email",
+    ),
+    path(
+        "resend-verification/",
+        ResendVerificationAPIView.as_view(),
+        name="auth-resend-verification",
+    ),
 ]
 
 # Note: User profiles and top lists functionality is now handled by the accounts app

backend/apps/api/v1/auth/views.py

@@ -6,7 +6,7 @@ login, signup, logout, password management, social authentication,
 user profiles, and top lists.
 """
 
-from .serializers.social import (
+from .serializers_package.social import (
     ConnectedProviderSerializer,
     AvailableProviderSerializer,
     SocialAuthStatusSerializer,
@@ -29,8 +29,8 @@ from rest_framework.response import Response
 from rest_framework.permissions import AllowAny, IsAuthenticated
 from drf_spectacular.utils import extend_schema, extend_schema_view
 
-# Import from the main serializers.py file (not the serializers package)
-from ..serializers import (
+# Import directly from the auth serializers.py file (not the serializers package)
+from .serializers import (
     # Authentication serializers
     LoginInputSerializer,
     LoginOutputSerializer,
@@ -177,8 +177,9 @@ class LoginAPIView(APIView):
 
             if user:
                 if getattr(user, "is_active", False):
-                    # pass a real HttpRequest to Django login
-                    login(_get_underlying_request(request), user)
+                    # pass a real HttpRequest to Django login with backend specified
+                    login(_get_underlying_request(request), user,
+                          backend='django.contrib.auth.backends.ModelBackend')
 
                     # Generate JWT tokens
                     from rest_framework_simplejwt.tokens import RefreshToken
@@ -197,7 +198,11 @@ class LoginAPIView(APIView):
                     return Response(response_serializer.data)
                 else:
                     return Response(
-                        {"error": "Account is disabled"},
+                        {
+                            "error": "Email verification required", 
+                            "message": "Please verify your email address before logging in. Check your email for a verification link.",
+                            "email_verification_required": True
+                        },
                         status=status.HTTP_400_BAD_REQUEST,
                     )
             else:
@@ -212,7 +217,7 @@ class LoginAPIView(APIView):
 @extend_schema_view(
     post=extend_schema(
         summary="User registration",
-        description="Register a new user account.",
+        description="Register a new user account. Email verification required.",
         request=SignupInputSerializer,
         responses={
             201: SignupOutputSerializer,
@@ -238,24 +243,18 @@ class SignupAPIView(APIView):
             # If mixin doesn't do anything, continue
             pass
 
-        serializer = SignupInputSerializer(data=request.data)
+        serializer = SignupInputSerializer(data=request.data, context={"request": request})
         if serializer.is_valid():
             user = serializer.save()
-            # pass a real HttpRequest to Django login
-            login(_get_underlying_request(request), user)  # type: ignore[arg-type]
-
-            # Generate JWT tokens
-            from rest_framework_simplejwt.tokens import RefreshToken
-
-            refresh = RefreshToken.for_user(user)
-            access_token = refresh.access_token
-
+            
+            # Don't log in the user immediately - they need to verify their email first
             response_serializer = SignupOutputSerializer(
                 {
-                    "access": str(access_token),
-                    "refresh": str(refresh),
+                    "access": None,
+                    "refresh": None,
                     "user": user,
-                    "message": "Registration successful",
+                    "message": "Registration successful. Please check your email to verify your account.",
+                    "email_verification_required": True,
                 }
             )
             return Response(response_serializer.data, status=status.HTTP_201_CREATED)
@@ -732,6 +731,153 @@ class SocialAuthStatusAPIView(APIView):
         return Response(serializer.data)
 
 
+# === EMAIL VERIFICATION API VIEWS ===
+
+
+@extend_schema_view(
+    get=extend_schema(
+        summary="Verify email address",
+        description="Verify user's email address using verification token.",
+        responses={
+            200: {"type": "object", "properties": {"message": {"type": "string"}}},
+            400: "Bad Request",
+            404: "Token not found",
+        },
+        tags=["Authentication"],
+    ),
+)
+class EmailVerificationAPIView(APIView):
+    """API endpoint for email verification."""
+
+    permission_classes = [AllowAny]
+    authentication_classes = []
+
+    def get(self, request: Request, token: str) -> Response:
+        from apps.accounts.models import EmailVerification
+        
+        try:
+            verification = EmailVerification.objects.select_related('user').get(token=token)
+            user = verification.user
+            
+            # Activate the user
+            user.is_active = True
+            user.save()
+            
+            # Delete the verification record
+            verification.delete()
+            
+            return Response({
+                "message": "Email verified successfully. You can now log in.",
+                "success": True
+            })
+            
+        except EmailVerification.DoesNotExist:
+            return Response(
+                {"error": "Invalid or expired verification token"},
+                status=status.HTTP_404_NOT_FOUND
+            )
+
+
+@extend_schema_view(
+    post=extend_schema(
+        summary="Resend verification email",
+        description="Resend email verification to user's email address.",
+        request={"type": "object", "properties": {"email": {"type": "string", "format": "email"}}},
+        responses={
+            200: {"type": "object", "properties": {"message": {"type": "string"}}},
+            400: "Bad Request",
+            404: "User not found",
+        },
+        tags=["Authentication"],
+    ),
+)
+class ResendVerificationAPIView(APIView):
+    """API endpoint to resend email verification."""
+
+    permission_classes = [AllowAny]
+    authentication_classes = []
+
+    def post(self, request: Request) -> Response:
+        from apps.accounts.models import EmailVerification
+        from django.utils.crypto import get_random_string
+        from django_forwardemail.services import EmailService
+        from django.contrib.sites.shortcuts import get_current_site
+        
+        email = request.data.get('email')
+        if not email:
+            return Response(
+                {"error": "Email address is required"},
+                status=status.HTTP_400_BAD_REQUEST
+            )
+        
+        try:
+            user = UserModel.objects.get(email__iexact=email.strip().lower())
+            
+            # Don't resend if user is already active
+            if user.is_active:
+                return Response(
+                    {"error": "Email is already verified"},
+                    status=status.HTTP_400_BAD_REQUEST
+                )
+            
+            # Create or update verification record
+            verification, created = EmailVerification.objects.get_or_create(
+                user=user,
+                defaults={'token': get_random_string(64)}
+            )
+            
+            if not created:
+                # Update existing token and timestamp
+                verification.token = get_random_string(64)
+                verification.save()
+            
+            # Send verification email
+            site = get_current_site(_get_underlying_request(request))
+            verification_url = request.build_absolute_uri(
+                f"/api/v1/auth/verify-email/{verification.token}/"
+            )
+            
+            try:
+                EmailService.send_email(
+                    to=user.email,
+                    subject="Verify your ThrillWiki account",
+                    text=f"""
+Welcome to ThrillWiki!
+
+Please verify your email address by clicking the link below:
+{verification_url}
+
+If you didn't create an account, you can safely ignore this email.
+
+Thanks,
+The ThrillWiki Team
+                    """.strip(),
+                    site=site,
+                )
+                
+                return Response({
+                    "message": "Verification email sent successfully",
+                    "success": True
+                })
+                
+            except Exception as e:
+                import logging
+                logger = logging.getLogger(__name__)
+                logger.error(f"Failed to send verification email to {user.email}: {e}")
+                
+                return Response(
+                    {"error": "Failed to send verification email"},
+                    status=status.HTTP_500_INTERNAL_SERVER_ERROR
+                )
+                
+        except UserModel.DoesNotExist:
+            # Don't reveal whether email exists
+            return Response({
+                "message": "If the email exists, a verification email has been sent",
+                "success": True
+            })
+
+
 # Note: User Profile, Top List, and Top List Item ViewSets are now handled
 # by the dedicated accounts app at backend/apps/api/v1/accounts/views.py
 # to avoid duplication and maintain clean separation of concerns.