mirror of
https://github.com/pacnpal/thrillwiki_django_no_react.git
synced 2025-12-20 02:11:08 -05:00
08a4a2d034
- Implemented PrimeProgress component with support for labels, helper text, and various styles (size, variant, color). - Created PrimeSelect component with dropdown functionality, custom templates, and validation states. - Developed PrimeSkeleton component for loading placeholders with different shapes and animations. - Updated index.ts to export new components for easy import. - Enhanced PrimeVueTest.vue to include tests for new components and their functionalities. - Introduced a custom ThrillWiki theme for PrimeVue with tailored color schemes and component styles. - Added ambient type declarations for various components to improve TypeScript support.
470 lines
15 KiB
Python
470 lines
15 KiB
Python
"""
|
|
Auth domain views for ThrillWiki API v1.
|
|
|
|
This module contains all authentication-related API endpoints including
|
|
login, signup, logout, password management, social authentication,
|
|
user profiles, and top lists.
|
|
"""
|
|
|
|
from django.contrib.auth import authenticate, login, logout, get_user_model
|
|
from django.contrib.sites.shortcuts import get_current_site
|
|
from django.core.exceptions import ValidationError
|
|
from django.db.models import Q
|
|
from typing import Optional, cast # added 'cast'
|
|
from django.http import HttpRequest # new import
|
|
from rest_framework import status
|
|
from rest_framework.views import APIView
|
|
from rest_framework.request import Request
|
|
from rest_framework.response import Response
|
|
from rest_framework.permissions import AllowAny, IsAuthenticated
|
|
from drf_spectacular.utils import extend_schema, extend_schema_view
|
|
|
|
from .serializers import (
|
|
# Authentication serializers
|
|
LoginInputSerializer,
|
|
LoginOutputSerializer,
|
|
SignupInputSerializer,
|
|
SignupOutputSerializer,
|
|
LogoutOutputSerializer,
|
|
UserOutputSerializer,
|
|
PasswordResetInputSerializer,
|
|
PasswordResetOutputSerializer,
|
|
PasswordChangeInputSerializer,
|
|
PasswordChangeOutputSerializer,
|
|
SocialProviderOutputSerializer,
|
|
AuthStatusOutputSerializer,
|
|
)
|
|
|
|
# Handle optional dependencies with fallback classes
|
|
|
|
|
|
class FallbackTurnstileMixin:
|
|
"""Fallback mixin if TurnstileMixin is not available."""
|
|
|
|
def validate_turnstile(self, request):
|
|
pass
|
|
|
|
|
|
# Try to import the real class, use fallback if not available and ensure it's a class/type
|
|
try:
|
|
from apps.accounts.mixins import TurnstileMixin as _ImportedTurnstileMixin
|
|
|
|
# Ensure the imported object is a class/type that can be used as a base class.
|
|
# If it's not a type for any reason, fall back to the safe mixin.
|
|
if isinstance(_ImportedTurnstileMixin, type):
|
|
TurnstileMixin = _ImportedTurnstileMixin
|
|
else:
|
|
TurnstileMixin = FallbackTurnstileMixin
|
|
except Exception:
|
|
# Catch any import errors or unexpected exceptions and use the fallback mixin.
|
|
TurnstileMixin = FallbackTurnstileMixin
|
|
|
|
UserModel = get_user_model()
|
|
|
|
# Helper: safely obtain underlying HttpRequest (used by Django auth)
|
|
|
|
|
|
def _get_underlying_request(request: Request) -> HttpRequest:
|
|
"""
|
|
Return a django HttpRequest for use with Django auth and site utilities.
|
|
|
|
DRF's Request wraps the underlying HttpRequest in ._request; cast() tells the
|
|
typechecker that the returned object is indeed an HttpRequest.
|
|
"""
|
|
return cast(HttpRequest, getattr(request, "_request", request))
|
|
|
|
|
|
# Helper: encapsulate user lookup + authenticate to reduce complexity in view
|
|
def _authenticate_user_by_lookup(
|
|
email_or_username: str, password: str, request: Request
|
|
) -> Optional[UserModel]:
|
|
"""
|
|
Try a single optimized query to find a user by email OR username then authenticate.
|
|
Returns authenticated user or None.
|
|
"""
|
|
try:
|
|
# Single query to find user by email OR username
|
|
if "@" in (email_or_username or ""):
|
|
user_obj = (
|
|
UserModel.objects.select_related()
|
|
.filter(Q(email=email_or_username) | Q(username=email_or_username))
|
|
.first()
|
|
)
|
|
else:
|
|
user_obj = (
|
|
UserModel.objects.select_related()
|
|
.filter(Q(username=email_or_username) | Q(email=email_or_username))
|
|
.first()
|
|
)
|
|
|
|
if user_obj:
|
|
username_val = getattr(user_obj, "username", None)
|
|
return authenticate(
|
|
# type: ignore[arg-type]
|
|
_get_underlying_request(request),
|
|
username=username_val,
|
|
password=password,
|
|
)
|
|
except Exception:
|
|
# Fallback to authenticate directly with provided identifier
|
|
return authenticate(
|
|
# type: ignore[arg-type]
|
|
_get_underlying_request(request),
|
|
username=email_or_username,
|
|
password=password,
|
|
)
|
|
|
|
return None
|
|
|
|
|
|
# === AUTHENTICATION API VIEWS ===
|
|
|
|
|
|
@extend_schema_view(
|
|
post=extend_schema(
|
|
summary="User login",
|
|
description="Authenticate user with username/email and password.",
|
|
request=LoginInputSerializer,
|
|
responses={
|
|
200: LoginOutputSerializer,
|
|
400: "Bad Request",
|
|
},
|
|
tags=["Authentication"],
|
|
),
|
|
)
|
|
class LoginAPIView(APIView):
|
|
"""API endpoint for user login."""
|
|
|
|
permission_classes = [AllowAny]
|
|
authentication_classes = []
|
|
serializer_class = LoginInputSerializer
|
|
|
|
def post(self, request: Request) -> Response:
|
|
try:
|
|
# instantiate mixin before calling to avoid type-mismatch in static analysis
|
|
TurnstileMixin().validate_turnstile(request)
|
|
except ValidationError as e:
|
|
return Response({"error": str(e)}, status=status.HTTP_400_BAD_REQUEST)
|
|
except Exception:
|
|
# If mixin doesn't do anything, continue
|
|
pass
|
|
|
|
serializer = LoginInputSerializer(data=request.data)
|
|
if serializer.is_valid():
|
|
validated = serializer.validated_data
|
|
# Use .get to satisfy static analyzers
|
|
email_or_username = validated.get("username") # type: ignore[assignment]
|
|
password = validated.get("password") # type: ignore[assignment]
|
|
|
|
if not email_or_username or not password:
|
|
return Response(
|
|
{"error": "username and password are required"},
|
|
status=status.HTTP_400_BAD_REQUEST,
|
|
)
|
|
|
|
user = _authenticate_user_by_lookup(email_or_username, password, request)
|
|
|
|
if user:
|
|
if getattr(user, "is_active", False):
|
|
# pass a real HttpRequest to Django login
|
|
login(_get_underlying_request(request), user)
|
|
from rest_framework.authtoken.models import Token
|
|
|
|
token, _ = Token.objects.get_or_create(user=user)
|
|
|
|
response_serializer = LoginOutputSerializer(
|
|
{
|
|
"token": token.key,
|
|
"user": user,
|
|
"message": "Login successful",
|
|
}
|
|
)
|
|
return Response(response_serializer.data)
|
|
else:
|
|
return Response(
|
|
{"error": "Account is disabled"},
|
|
status=status.HTTP_400_BAD_REQUEST,
|
|
)
|
|
else:
|
|
return Response(
|
|
{"error": "Invalid credentials"},
|
|
status=status.HTTP_400_BAD_REQUEST,
|
|
)
|
|
|
|
return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
|
|
|
|
|
|
@extend_schema_view(
|
|
post=extend_schema(
|
|
summary="User registration",
|
|
description="Register a new user account.",
|
|
request=SignupInputSerializer,
|
|
responses={
|
|
201: SignupOutputSerializer,
|
|
400: "Bad Request",
|
|
},
|
|
tags=["Authentication"],
|
|
),
|
|
)
|
|
class SignupAPIView(APIView):
|
|
"""API endpoint for user registration."""
|
|
|
|
permission_classes = [AllowAny]
|
|
authentication_classes = []
|
|
serializer_class = SignupInputSerializer
|
|
|
|
def post(self, request: Request) -> Response:
|
|
try:
|
|
# instantiate mixin before calling to avoid type-mismatch in static analysis
|
|
TurnstileMixin().validate_turnstile(request)
|
|
except ValidationError as e:
|
|
return Response({"error": str(e)}, status=status.HTTP_400_BAD_REQUEST)
|
|
except Exception:
|
|
# If mixin doesn't do anything, continue
|
|
pass
|
|
|
|
serializer = SignupInputSerializer(data=request.data)
|
|
if serializer.is_valid():
|
|
user = serializer.save()
|
|
# pass a real HttpRequest to Django login
|
|
login(_get_underlying_request(request), user) # type: ignore[arg-type]
|
|
from rest_framework.authtoken.models import Token
|
|
|
|
token, _ = Token.objects.get_or_create(user=user)
|
|
|
|
response_serializer = SignupOutputSerializer(
|
|
{
|
|
"token": token.key,
|
|
"user": user,
|
|
"message": "Registration successful",
|
|
}
|
|
)
|
|
return Response(response_serializer.data, status=status.HTTP_201_CREATED)
|
|
|
|
return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
|
|
|
|
|
|
@extend_schema_view(
|
|
post=extend_schema(
|
|
summary="User logout",
|
|
description="Logout the current user and invalidate their token.",
|
|
responses={
|
|
200: LogoutOutputSerializer,
|
|
401: "Unauthorized",
|
|
},
|
|
tags=["Authentication"],
|
|
),
|
|
)
|
|
class LogoutAPIView(APIView):
|
|
"""API endpoint for user logout."""
|
|
|
|
permission_classes = [IsAuthenticated]
|
|
serializer_class = LogoutOutputSerializer
|
|
|
|
def post(self, request: Request) -> Response:
|
|
try:
|
|
# Delete the token for token-based auth
|
|
if hasattr(request.user, "auth_token"):
|
|
request.user.auth_token.delete()
|
|
|
|
# Logout from session using the underlying HttpRequest
|
|
logout(_get_underlying_request(request))
|
|
|
|
response_serializer = LogoutOutputSerializer(
|
|
{"message": "Logout successful"}
|
|
)
|
|
return Response(response_serializer.data)
|
|
except Exception:
|
|
return Response(
|
|
{"error": "Logout failed"}, status=status.HTTP_500_INTERNAL_SERVER_ERROR
|
|
)
|
|
|
|
|
|
@extend_schema_view(
|
|
get=extend_schema(
|
|
summary="Get current user",
|
|
description="Retrieve information about the currently authenticated user.",
|
|
responses={
|
|
200: UserOutputSerializer,
|
|
401: "Unauthorized",
|
|
},
|
|
tags=["Authentication"],
|
|
),
|
|
)
|
|
class CurrentUserAPIView(APIView):
|
|
"""API endpoint to get current user information."""
|
|
|
|
permission_classes = [IsAuthenticated]
|
|
serializer_class = UserOutputSerializer
|
|
|
|
def get(self, request: Request) -> Response:
|
|
serializer = UserOutputSerializer(request.user)
|
|
return Response(serializer.data)
|
|
|
|
|
|
@extend_schema_view(
|
|
post=extend_schema(
|
|
summary="Request password reset",
|
|
description="Send a password reset email to the user.",
|
|
request=PasswordResetInputSerializer,
|
|
responses={
|
|
200: PasswordResetOutputSerializer,
|
|
400: "Bad Request",
|
|
},
|
|
tags=["Authentication"],
|
|
),
|
|
)
|
|
class PasswordResetAPIView(APIView):
|
|
"""API endpoint to request password reset."""
|
|
|
|
permission_classes = [AllowAny]
|
|
serializer_class = PasswordResetInputSerializer
|
|
|
|
def post(self, request: Request) -> Response:
|
|
serializer = PasswordResetInputSerializer(
|
|
data=request.data, context={"request": request}
|
|
)
|
|
if serializer.is_valid():
|
|
serializer.save()
|
|
|
|
response_serializer = PasswordResetOutputSerializer(
|
|
{"detail": "Password reset email sent"}
|
|
)
|
|
return Response(response_serializer.data)
|
|
|
|
return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
|
|
|
|
|
|
@extend_schema_view(
|
|
post=extend_schema(
|
|
summary="Change password",
|
|
description="Change the current user's password.",
|
|
request=PasswordChangeInputSerializer,
|
|
responses={
|
|
200: PasswordChangeOutputSerializer,
|
|
400: "Bad Request",
|
|
401: "Unauthorized",
|
|
},
|
|
tags=["Authentication"],
|
|
),
|
|
)
|
|
class PasswordChangeAPIView(APIView):
|
|
"""API endpoint to change password."""
|
|
|
|
permission_classes = [IsAuthenticated]
|
|
serializer_class = PasswordChangeInputSerializer
|
|
|
|
def post(self, request: Request) -> Response:
|
|
serializer = PasswordChangeInputSerializer(
|
|
data=request.data, context={"request": request}
|
|
)
|
|
if serializer.is_valid():
|
|
serializer.save()
|
|
|
|
response_serializer = PasswordChangeOutputSerializer(
|
|
{"detail": "Password changed successfully"}
|
|
)
|
|
return Response(response_serializer.data)
|
|
|
|
return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
|
|
|
|
|
|
@extend_schema_view(
|
|
get=extend_schema(
|
|
summary="Get social providers",
|
|
description="Retrieve available social authentication providers.",
|
|
responses={200: "List of social providers"},
|
|
tags=["Authentication"],
|
|
),
|
|
)
|
|
class SocialProvidersAPIView(APIView):
|
|
"""API endpoint to get available social authentication providers."""
|
|
|
|
permission_classes = [AllowAny]
|
|
serializer_class = SocialProviderOutputSerializer
|
|
|
|
def get(self, request: Request) -> Response:
|
|
from django.core.cache import cache
|
|
|
|
# get_current_site expects a django HttpRequest; _get_underlying_request now returns HttpRequest
|
|
site = get_current_site(_get_underlying_request(request))
|
|
|
|
# Cache key based on site and request host - use getattr to avoid attribute errors
|
|
site_id = getattr(site, "id", getattr(site, "pk", None))
|
|
cache_key = f"social_providers:{site_id}:{request.get_host()}"
|
|
|
|
# Try to get from cache first (cache for 15 minutes)
|
|
cached_providers = cache.get(cache_key)
|
|
if cached_providers is not None:
|
|
return Response(cached_providers)
|
|
|
|
providers_list = []
|
|
|
|
# Optimized query: filter by site and order by provider name
|
|
from allauth.socialaccount.models import SocialApp
|
|
|
|
social_apps = SocialApp.objects.filter(sites=site).order_by("provider")
|
|
|
|
for social_app in social_apps:
|
|
try:
|
|
provider_name = (
|
|
social_app.name or getattr(social_app, "provider", "").title()
|
|
)
|
|
|
|
auth_url = request.build_absolute_uri(
|
|
f"/accounts/{social_app.provider}/login/"
|
|
)
|
|
|
|
providers_list.append(
|
|
{
|
|
"id": social_app.provider,
|
|
"name": provider_name,
|
|
"authUrl": auth_url,
|
|
}
|
|
)
|
|
|
|
except Exception:
|
|
continue
|
|
|
|
serializer = SocialProviderOutputSerializer(providers_list, many=True)
|
|
response_data = serializer.data
|
|
|
|
cache.set(cache_key, response_data, 900)
|
|
|
|
return Response(response_data)
|
|
|
|
|
|
@extend_schema_view(
|
|
post=extend_schema(
|
|
summary="Check authentication status",
|
|
description="Check if user is authenticated and return user data.",
|
|
responses={200: AuthStatusOutputSerializer},
|
|
tags=["Authentication"],
|
|
),
|
|
)
|
|
class AuthStatusAPIView(APIView):
|
|
"""API endpoint to check authentication status."""
|
|
|
|
permission_classes = [AllowAny]
|
|
serializer_class = AuthStatusOutputSerializer
|
|
|
|
def post(self, request: Request) -> Response:
|
|
if request.user.is_authenticated:
|
|
response_data = {
|
|
"authenticated": True,
|
|
"user": request.user,
|
|
}
|
|
else:
|
|
response_data = {
|
|
"authenticated": False,
|
|
"user": None,
|
|
}
|
|
|
|
serializer = AuthStatusOutputSerializer(response_data)
|
|
return Response(serializer.data)
|
|
|
|
|
|
# Note: User Profile, Top List, and Top List Item ViewSets are now handled
|
|
# by the dedicated accounts app at backend/apps/api/v1/accounts/views.py
|
|
# to avoid duplication and maintain clean separation of concerns.
|