add permission and token validation

Author: jsun1590

server/api/apps/auth/passwords/apps.py

@@ -1,13 +1,18 @@
 from rest_framework import serializers
-from api.apps.users.models import User
+from django.contrib.auth.password_validation import validate_password
+
 
 class ChangePasswordSerializer(serializers.Serializer):
     email = serializers.CharField(required=True)
     new_password = serializers.CharField(required=True)
 
+    def validate_new_password(self, value):
+        validate_password(value)
+        return value
+
 
 class EmailSerializer(serializers.Serializer):
     email = serializers.EmailField()
 
     class Meta:
-        fields = ("email")
+        fields = "email"

server/api/apps/auth/passwords/urls.py

@@ -0,0 +1,11 @@
+from django.urls import path
+from .views import ResetPasswordView, EmailResetLinkView
+
+urlpatterns = [
+    path("email/", EmailResetLinkView.as_view(), name="send-reset-email"),
+    path(
+        "",
+        ResetPasswordView.as_view(),
+        name="reset",
+    ),
+]

server/api/apps/auth/passwords/views.py

@@ -0,0 +1,140 @@
+from smtplib import SMTPAuthenticationError
+
+from django.conf import settings
+from django.contrib.auth import get_user_model
+from django.contrib.auth.tokens import PasswordResetTokenGenerator
+from django.core.mail import send_mail
+from django.utils.encoding import force_bytes, force_str
+from django.utils.http import urlsafe_base64_encode, urlsafe_base64_decode
+from rest_framework import generics, status
+from rest_framework.response import Response
+
+from .serializers import ChangePasswordSerializer, EmailSerializer
+
+
+# Create your views here.
+class ResetPasswordView(generics.RetrieveUpdateAPIView):
+    """
+    An endpoint for changing password.
+    """
+
+    serializer_class = ChangePasswordSerializer
+
+    def validate_token(self, request):
+        token = request.GET.get("token", "").rstrip("/")
+        uid = None
+        try:
+            uidb64 = request.GET.get("uid", "").rstrip("/")
+            if uidb64 != "":
+                uid = force_str(urlsafe_base64_decode(uidb64))
+        except ValueError:
+            pass
+
+        user = get_user_model().objects.filter(email=uid).first()
+
+        is_valid_token = PasswordResetTokenGenerator().check_token(
+            token=token, user=user
+        )
+        return is_valid_token
+
+    def get(self, request, *args, **kwargs):
+        if not self.validate_token(request):
+            return Response(
+                {
+                    "message": (
+                        "the password reset token is invalid or has expired."
+                    )
+                },
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        return Response(
+            {"message": "the password reset token is valid"},
+            status=status.HTTP_200_OK,
+        )
+
+    def update(self, request, *args, **kwargs):
+        if not self.validate_token(request):
+            return Response(
+                {
+                    "message": (
+                        "the password reset token is invalid or has expired."
+                    )
+                },
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        serializer = self.get_serializer(data=request.data)
+
+        if not serializer.is_valid():
+            return Response(
+                serializer.errors, status=status.HTTP_400_BAD_REQUEST
+            )
+
+        user = (
+            get_user_model()
+            .objects.filter(email=serializer.data.get("email"))
+            .first()
+        )
+
+        if not user:
+            return Response(
+                {"message": "Email does not exist"},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        user.set_password(serializer.data.get("new_password"))
+        user.save()
+
+        return Response(
+            {"message": "Password updated successfully"},
+            status=status.HTTP_200_OK,
+        )
+
+
+class EmailResetLinkView(generics.GenericAPIView):
+    """
+    An endpoint for emailing reset password links.
+    """
+
+    serializer_class = EmailSerializer
+
+    def post(self, request):
+        serializer = self.get_serializer(data=request.data)
+        if not serializer.is_valid():
+            return Response(
+                serializer.errors, status=status.HTTP_400_BAD_REQUEST
+            )
+
+        email = serializer.data["email"]
+        user = get_user_model().objects.filter(email=email).first()
+
+        if not user:
+            return Response(
+                {"message": "Email does not exist"},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        token = PasswordResetTokenGenerator().make_token(user)
+        uid = urlsafe_base64_encode(force_bytes(user.email))
+
+        reset_url = f"{settings.FRONTEND_URL}/reset/?token={token}&uid={uid}/"
+
+        try:
+            send_mail(
+                "Elucidate Password Reset",
+                f"Your password reset link can be found at: {reset_url}\n"
+                + "It will expire in"
+                f" {settings.PASSWORD_RESET_TIMEOUT / 60} minutes.",
+                settings.EMAIL_HOST_USER,
+                [email],
+                fail_silently=False,
+            )
+        except SMTPAuthenticationError:
+            return Response(
+                status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            )
+
+        return Response(
+            {"message": "Email has been sent"}, status=status.HTTP_200_OK
+        )

…rver/api/apps/auth/passwords/__init__.py server/api/apps/auth/reset/__init__.pyserver/api/apps/auth/passwords/__init__.py renamed to server/api/apps/auth/reset/__init__.py server/api/apps/auth/passwords/__init__.py renamed to server/api/apps/auth/reset/__init__.py

@@ -1,13 +1,12 @@
+from django.contrib.auth import get_user_model
 from django.contrib.auth.password_validation import validate_password
 from rest_framework import serializers
 from rest_framework.serializers import ValidationError
 
-from api.apps.users.models import User
-
 
 class RegistrationSerializer(serializers.ModelSerializer):
     class Meta:
-        model = User
+        model = get_user_model()
         fields = (
             "id",
             "email",
@@ -33,6 +32,6 @@ def validate_password(self, value):
         return value
 
     def create(self, validated_data):
-        user = User.objects.create_user(**validated_data)
+        user = get_user_model().objects.create_user(**validated_data)
 
         return user

…ps/auth/passwords/migrations/__init__.py …i/apps/auth/reset/migrations/__init__.pyserver/api/apps/auth/passwords/migrations/__init__.py renamed to server/api/apps/auth/reset/migrations/__init__.py server/api/apps/auth/passwords/migrations/__init__.py renamed to server/api/apps/auth/reset/migrations/__init__.py

@@ -12,5 +12,5 @@
     path("refresh/", refresh_jwt_token, name="refresh-jwt-token"),
     path("verify/", verify_jwt_token, name="verify-jwt-token"),
     path("register/", RegistrationView.as_view(), name="register"),
-    path("reset/", include("api.apps.auth.passwords.urls")),
+    path("reset/", include("api.apps.auth.reset.urls")),
 ]