mobiniqow
a464e550c9
Full-stack implementation of the Cyberyan full-stack trial task. Backend (Django 5 / DRF) - Normalised PostgreSQL model (Profile, Company, School, Skill, Experience, Education) as the source of truth, with GIN + trigram indexes. - Self-healing CSV reader: the supplied export carries an injected watermark column, missing columns, rows split by broken quoting and a duplicated header. A signature-scored Needleman-Wunsch alignment reconstructs 284 clean records out of 336 physical rows; only 10 rows parse correctly without it. - Pluggable search layer (Strategy): Elasticsearch by default, PostgreSQL full-text search as a fallback selected by a single environment variable. - Keyword search with per-field boosts, fuzziness and phrase boosting, six faceted filters (OR within a filter, AND across filters), an experience range, four sort orders, highlighting and facet aggregations. - JWT auth with rotation + blacklist, three roles, PII masking, scoped rate limits, a single error envelope, OpenAPI schema and health probes. Frontend (React 18 / TypeScript / Vite) - Debounced search with type-ahead, faceted filter panel, result cards, profile drawer, URL-synced search state, automatic token refresh. - Highlight snippets rendered without dangerouslySetInnerHTML. Infrastructure - Hardened multi-stage images (non-root, read-only rootfs, healthchecks). - docker-compose for the full stack plus dev and production overlays. - ELK: structured JSON logs shipped asynchronously to Logstash, routed per event type, with a composable index template and a Kibana setup script. Quality - 61 backend tests (85% coverage), ruff/black/bandit/mypy, ESLint + tsc, GitHub Actions running lint, tests and both image builds. - Persian documentation: README plus architecture, search, API, data, security and operations guides. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GnFo6fNaHCTAkJbfcdkqtG
86 lines
3.1 KiB
Python
86 lines
3.1 KiB
Python
"""Authentication endpoints: register, login, refresh, logout, me."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import contextlib
|
|
import logging
|
|
|
|
from drf_spectacular.utils import extend_schema
|
|
from rest_framework import generics, status
|
|
from rest_framework.permissions import AllowAny, IsAuthenticated
|
|
from rest_framework.request import Request
|
|
from rest_framework.response import Response
|
|
from rest_framework.views import APIView
|
|
from rest_framework_simplejwt.exceptions import TokenError
|
|
from rest_framework_simplejwt.tokens import RefreshToken
|
|
from rest_framework_simplejwt.views import TokenObtainPairView as BaseTokenObtainPairView
|
|
from rest_framework_simplejwt.views import TokenRefreshView as BaseTokenRefreshView
|
|
|
|
from apps.accounts.models import User
|
|
from apps.accounts.serializers import LogoutSerializer, RegisterSerializer, UserSerializer
|
|
from apps.core.throttling import LoginRateThrottle
|
|
|
|
audit = logging.getLogger("audit.auth")
|
|
|
|
|
|
@extend_schema(tags=["auth"])
|
|
class RegisterView(generics.CreateAPIView):
|
|
"""Self-service sign-up. New accounts always get the ``viewer`` role."""
|
|
|
|
serializer_class = RegisterSerializer
|
|
permission_classes = [AllowAny]
|
|
throttle_classes = [LoginRateThrottle]
|
|
queryset = User.objects.all()
|
|
|
|
def create(self, request: Request, *args, **kwargs) -> Response:
|
|
serializer = self.get_serializer(data=request.data)
|
|
serializer.is_valid(raise_exception=True)
|
|
user = serializer.save()
|
|
audit.info("user_registered", extra={"event": "user_registered", "user_id": user.id})
|
|
return Response(UserSerializer(user).data, status=status.HTTP_201_CREATED)
|
|
|
|
|
|
@extend_schema(tags=["auth"])
|
|
class LoginView(BaseTokenObtainPairView):
|
|
"""Exchange credentials for an access/refresh token pair."""
|
|
|
|
permission_classes = [AllowAny]
|
|
throttle_classes = [LoginRateThrottle]
|
|
|
|
|
|
@extend_schema(tags=["auth"])
|
|
class RefreshView(BaseTokenRefreshView):
|
|
"""Rotate a refresh token; the presented token is blacklisted afterwards."""
|
|
|
|
permission_classes = [AllowAny]
|
|
throttle_classes = [LoginRateThrottle]
|
|
|
|
|
|
@extend_schema(tags=["auth"], request=LogoutSerializer, responses={205: None})
|
|
class LogoutView(APIView):
|
|
"""Blacklist a refresh token so it can no longer be rotated."""
|
|
|
|
permission_classes = [IsAuthenticated]
|
|
serializer_class = LogoutSerializer
|
|
|
|
def post(self, request: Request) -> Response:
|
|
serializer = LogoutSerializer(data=request.data)
|
|
serializer.is_valid(raise_exception=True)
|
|
# An already-invalid token is not an error worth surfacing: the
|
|
# caller's intent (be logged out) is satisfied either way.
|
|
with contextlib.suppress(TokenError):
|
|
RefreshToken(serializer.validated_data["refresh"]).blacklist()
|
|
audit.info("logout", extra={"event": "logout", "user_id": request.user.id})
|
|
return Response(status=status.HTTP_205_RESET_CONTENT)
|
|
|
|
|
|
@extend_schema(tags=["auth"])
|
|
class MeView(generics.RetrieveAPIView):
|
|
"""Identity and effective privileges of the calling user."""
|
|
|
|
serializer_class = UserSerializer
|
|
permission_classes = [IsAuthenticated]
|
|
|
|
def get_object(self) -> User:
|
|
return self.request.user
|