mirror of
https://github.com/Tivix/django-rest-auth.git
synced 2024-12-03 14:23:43 +03:00
40208ea0b6
Rather than importing it at the top level (which breaks dj-rest-auth entirely if you aren't using JWTs and don't have the library installed), only do the import if the user has the relevant setting enabled.
286 lines
10 KiB
Python
286 lines
10 KiB
Python
from django.conf import settings
|
|
from django.contrib.auth import get_user_model
|
|
from django.contrib.auth import login as django_login
|
|
from django.contrib.auth import logout as django_logout
|
|
from django.core.exceptions import ObjectDoesNotExist
|
|
from django.utils.decorators import method_decorator
|
|
from django.utils.translation import ugettext_lazy as _
|
|
from django.views.decorators.debug import sensitive_post_parameters
|
|
from rest_framework import status
|
|
from rest_framework.generics import GenericAPIView, RetrieveUpdateAPIView
|
|
from rest_framework.permissions import AllowAny, IsAuthenticated
|
|
from rest_framework.response import Response
|
|
from rest_framework.views import APIView
|
|
|
|
if getattr(settings, 'REST_USE_JWT'):
|
|
from rest_framework_simplejwt.exceptions import TokenError
|
|
from rest_framework_simplejwt.tokens import RefreshToken
|
|
else:
|
|
# NOTE: these are not actually used except if `REST_USE_JWT` is True, but
|
|
# ensuring they're defined anyway in case
|
|
|
|
class TokenError(Exception):
|
|
pass
|
|
|
|
class RefreshToken:
|
|
pass
|
|
|
|
|
|
from .app_settings import (JWTSerializer, LoginSerializer,
|
|
PasswordChangeSerializer,
|
|
PasswordResetConfirmSerializer,
|
|
PasswordResetSerializer, TokenSerializer,
|
|
UserDetailsSerializer, create_token)
|
|
from .models import TokenModel
|
|
from .utils import jwt_encode
|
|
|
|
sensitive_post_parameters_m = method_decorator(
|
|
sensitive_post_parameters(
|
|
'password', 'old_password', 'new_password1', 'new_password2'
|
|
)
|
|
)
|
|
|
|
|
|
class LoginView(GenericAPIView):
|
|
"""
|
|
Check the credentials and return the REST Token
|
|
if the credentials are valid and authenticated.
|
|
Calls Django Auth login method to register User ID
|
|
in Django session framework
|
|
|
|
Accept the following POST parameters: username, password
|
|
Return the REST Framework Token Object's key.
|
|
"""
|
|
permission_classes = (AllowAny,)
|
|
serializer_class = LoginSerializer
|
|
token_model = TokenModel
|
|
|
|
@sensitive_post_parameters_m
|
|
def dispatch(self, *args, **kwargs):
|
|
return super(LoginView, self).dispatch(*args, **kwargs)
|
|
|
|
def process_login(self):
|
|
django_login(self.request, self.user)
|
|
|
|
def get_response_serializer(self):
|
|
if getattr(settings, 'REST_USE_JWT', False):
|
|
response_serializer = JWTSerializer
|
|
else:
|
|
response_serializer = TokenSerializer
|
|
return response_serializer
|
|
|
|
def login(self):
|
|
self.user = self.serializer.validated_data['user']
|
|
|
|
if getattr(settings, 'REST_USE_JWT', False):
|
|
self.access_token, self.refresh_token = jwt_encode(self.user)
|
|
else:
|
|
self.token = create_token(self.token_model, self.user,
|
|
self.serializer)
|
|
|
|
if getattr(settings, 'REST_SESSION_LOGIN', True):
|
|
self.process_login()
|
|
|
|
def get_response(self):
|
|
serializer_class = self.get_response_serializer()
|
|
|
|
if getattr(settings, 'REST_USE_JWT', False):
|
|
data = {
|
|
'user': self.user,
|
|
'access_token': self.access_token,
|
|
'refresh_token': self.refresh_token
|
|
}
|
|
serializer = serializer_class(instance=data,
|
|
context={'request': self.request})
|
|
else:
|
|
serializer = serializer_class(instance=self.token,
|
|
context={'request': self.request})
|
|
|
|
response = Response(serializer.data, status=status.HTTP_200_OK)
|
|
if getattr(settings, 'REST_USE_JWT', False):
|
|
cookie_name = getattr(settings, 'JWT_AUTH_COOKIE', None)
|
|
from rest_framework_simplejwt.settings import api_settings as jwt_settings
|
|
if cookie_name:
|
|
from datetime import datetime
|
|
expiration = (datetime.utcnow() + jwt_settings.ACCESS_TOKEN_LIFETIME)
|
|
response.set_cookie(
|
|
cookie_name,
|
|
self.access_token,
|
|
expires=expiration,
|
|
httponly=True
|
|
)
|
|
return response
|
|
|
|
def post(self, request, *args, **kwargs):
|
|
self.request = request
|
|
self.serializer = self.get_serializer(data=self.request.data,
|
|
context={'request': request})
|
|
self.serializer.is_valid(raise_exception=True)
|
|
|
|
self.login()
|
|
return self.get_response()
|
|
|
|
|
|
class LogoutView(APIView):
|
|
"""
|
|
Calls Django logout method and delete the Token object
|
|
assigned to the current User object.
|
|
|
|
Accepts/Returns nothing.
|
|
"""
|
|
permission_classes = (AllowAny,)
|
|
|
|
def get(self, request, *args, **kwargs):
|
|
if getattr(settings, 'ACCOUNT_LOGOUT_ON_GET', False):
|
|
response = self.logout(request)
|
|
else:
|
|
response = self.http_method_not_allowed(request, *args, **kwargs)
|
|
|
|
return self.finalize_response(request, response, *args, **kwargs)
|
|
|
|
def post(self, request, *args, **kwargs):
|
|
return self.logout(request)
|
|
|
|
def logout(self, request):
|
|
try:
|
|
request.user.auth_token.delete()
|
|
except (AttributeError, ObjectDoesNotExist):
|
|
pass
|
|
|
|
if getattr(settings, 'REST_SESSION_LOGIN', True):
|
|
django_logout(request)
|
|
|
|
response = Response({"detail": _("Successfully logged out.")},
|
|
status=status.HTTP_200_OK)
|
|
|
|
if getattr(settings, 'REST_USE_JWT', False):
|
|
cookie_name = getattr(settings, 'JWT_AUTH_COOKIE', None)
|
|
if cookie_name:
|
|
response.delete_cookie(cookie_name)
|
|
|
|
elif 'rest_framework_simplejwt.token_blacklist' in settings.INSTALLED_APPS:
|
|
# add refresh token to blacklist
|
|
try:
|
|
token = RefreshToken(request.data['refresh'])
|
|
token.blacklist()
|
|
|
|
except KeyError:
|
|
response = Response({"detail": _("Refresh token was not included in request data.")},
|
|
status=status.HTTP_401_UNAUTHORIZED)
|
|
|
|
except (TokenError, AttributeError, TypeError) as error:
|
|
if hasattr(error, 'args'):
|
|
if 'Token is blacklisted' in error.args or 'Token is invalid or expired' in error.args:
|
|
response = Response({"detail": _(error.args[0])},
|
|
status=status.HTTP_401_UNAUTHORIZED)
|
|
|
|
else:
|
|
response = Response({"detail": _("An error has occurred.")},
|
|
status=status.HTTP_500_INTERNAL_SERVER_ERROR)
|
|
|
|
else:
|
|
response = Response({"detail": _("An error has occurred.")},
|
|
status=status.HTTP_500_INTERNAL_SERVER_ERROR)
|
|
|
|
else:
|
|
response = Response({
|
|
"detail": _("Neither cookies or blacklist are enabled, so the token has not been deleted server "
|
|
"side. Please make sure the token is deleted client side."
|
|
)}, status=status.HTTP_200_OK)
|
|
|
|
return response
|
|
|
|
|
|
class UserDetailsView(RetrieveUpdateAPIView):
|
|
"""
|
|
Reads and updates UserModel fields
|
|
Accepts GET, PUT, PATCH methods.
|
|
|
|
Default accepted fields: username, first_name, last_name
|
|
Default display fields: pk, username, email, first_name, last_name
|
|
Read-only fields: pk, email
|
|
|
|
Returns UserModel fields.
|
|
"""
|
|
serializer_class = UserDetailsSerializer
|
|
permission_classes = (IsAuthenticated,)
|
|
|
|
def get_object(self):
|
|
return self.request.user
|
|
|
|
def get_queryset(self):
|
|
"""
|
|
Adding this method since it is sometimes called when using
|
|
django-rest-swagger
|
|
"""
|
|
return get_user_model().objects.none()
|
|
|
|
|
|
class PasswordResetView(GenericAPIView):
|
|
"""
|
|
Calls Django Auth PasswordResetForm save method.
|
|
|
|
Accepts the following POST parameters: email
|
|
Returns the success/fail message.
|
|
"""
|
|
serializer_class = PasswordResetSerializer
|
|
permission_classes = (AllowAny,)
|
|
|
|
def post(self, request, *args, **kwargs):
|
|
# Create a serializer with request.data
|
|
serializer = self.get_serializer(data=request.data)
|
|
serializer.is_valid(raise_exception=True)
|
|
|
|
serializer.save()
|
|
# Return the success message with OK HTTP status
|
|
return Response(
|
|
{"detail": _("Password reset e-mail has been sent.")},
|
|
status=status.HTTP_200_OK
|
|
)
|
|
|
|
|
|
class PasswordResetConfirmView(GenericAPIView):
|
|
"""
|
|
Password reset e-mail link is confirmed, therefore
|
|
this resets the user's password.
|
|
|
|
Accepts the following POST parameters: token, uid,
|
|
new_password1, new_password2
|
|
Returns the success/fail message.
|
|
"""
|
|
serializer_class = PasswordResetConfirmSerializer
|
|
permission_classes = (AllowAny,)
|
|
|
|
@sensitive_post_parameters_m
|
|
def dispatch(self, *args, **kwargs):
|
|
return super(PasswordResetConfirmView, self).dispatch(*args, **kwargs)
|
|
|
|
def post(self, request, *args, **kwargs):
|
|
serializer = self.get_serializer(data=request.data)
|
|
serializer.is_valid(raise_exception=True)
|
|
serializer.save()
|
|
return Response(
|
|
{"detail": _("Password has been reset with the new password.")}
|
|
)
|
|
|
|
|
|
class PasswordChangeView(GenericAPIView):
|
|
"""
|
|
Calls Django Auth SetPasswordForm save method.
|
|
|
|
Accepts the following POST parameters: new_password1, new_password2
|
|
Returns the success/fail message.
|
|
"""
|
|
serializer_class = PasswordChangeSerializer
|
|
permission_classes = (IsAuthenticated,)
|
|
|
|
@sensitive_post_parameters_m
|
|
def dispatch(self, *args, **kwargs):
|
|
return super(PasswordChangeView, self).dispatch(*args, **kwargs)
|
|
|
|
def post(self, request, *args, **kwargs):
|
|
serializer = self.get_serializer(data=request.data)
|
|
serializer.is_valid(raise_exception=True)
|
|
serializer.save()
|
|
return Response({"detail": _("New password has been saved.")})
|