add documentation and tests

Author: jsun1590

…mentation/docs/backend/authentication.md …backend/authentication/authentication.mddocumentation/docs/backend/authentication.md renamed to documentation/docs/backend/authentication/authentication.md documentation/docs/backend/authentication.md renamed to documentation/docs/backend/authentication/authentication.md

@@ -16,6 +16,7 @@ This API is used to manage the authentication lifecycle. It allows us to:
 /api/auth
 
 ----  
+
 **Endpoints:**
 
 ## /register/

documentation/docs/backend/authentication/password-reset.md

@@ -0,0 +1,61 @@
+# Authentication REST API
+
+----
+This API is used to manage the password reset lifecycle. It allows us to:
+
+* Send a password reset email with an SMTP server (currently configured for gmail)
+* Verfiy that a token and associated uid is valid
+* Reset the user password using a valid token and associated uid
+
+----
+**Base URL:**
+
+/api/auth/reset
+
+----  
+
+**Endpoints:**
+
+## /
+
+Methods: POST, PUT
+Description: PUT to veriy that a token/uid pair is valid. POST to change passwords.
+
+**URL Parameters**
+
+  | Key   | Data Type | Description                                            |
+  | :---- | :-------: | :----------------------------------------------------- |
+  | token |  String   | A password reset token.                                |
+  | uid   |  String   | The url-safe base64 encoded email address of the user. |
+
+**Data Parameters:**
+
+  | Key      | Data Type | Description       |
+  | :------- | :-------: | :---------------- |
+  | password |  String   | The new password. |
+
+Example request
+
+```json
+{
+    "password": "123456",
+}
+```
+
+Example response
+
+```json
+// TODO
+```
+
+## /email/
+
+Methods: POST
+Description: Register an user. Returns the user JSON as the response.
+Success status code: 200 OK
+
+**Data Parameters:**
+
+  | Key   | Data Type | Description            |
+  | :---- | :-------: | :--------------------- |
+  | email |  String   | The email of the user. |

server/api/apps/auth/reset/__init__.py …api/apps/auth/reset_password/__init__.pyserver/api/apps/auth/reset/__init__.py renamed to server/api/apps/auth/reset_password/__init__.py server/api/apps/auth/reset/__init__.py renamed to server/api/apps/auth/reset_password/__init__.py

@@ -3,10 +3,9 @@
 
 
 class ChangePasswordSerializer(serializers.Serializer):
-    email = serializers.CharField(required=True)
-    new_password = serializers.CharField(required=True)
+    password = serializers.CharField(required=True)
 
-    def validate_new_password(self, value):
+    def validate_password(self, value):
         validate_password(value)
         return value
 

…i/apps/auth/reset/migrations/__init__.py …th/reset_password/migrations/__init__.pyserver/api/apps/auth/reset/migrations/__init__.py renamed to server/api/apps/auth/reset_password/migrations/__init__.py server/api/apps/auth/reset/migrations/__init__.py renamed to server/api/apps/auth/reset_password/migrations/__init__.py

@@ -35,10 +35,11 @@ def validate_token(self, request):
         is_valid_token = PasswordResetTokenGenerator().check_token(
             token=token, user=user
         )
-        return is_valid_token
+        return is_valid_token, user
 
     def get(self, request, *args, **kwargs):
-        if not self.validate_token(request):
+        is_valid_token, user = self.validate_token(request)
+        if not is_valid_token:
             return Response(
                 {
                     "message": (
@@ -54,7 +55,8 @@ def get(self, request, *args, **kwargs):
         )
 
     def update(self, request, *args, **kwargs):
-        if not self.validate_token(request):
+        is_valid_token, user = self.validate_token(request)
+        if not is_valid_token:
             return Response(
                 {
                     "message": (
@@ -71,19 +73,13 @@ def update(self, request, *args, **kwargs):
                 serializer.errors, status=status.HTTP_400_BAD_REQUEST
             )
 
-        user = (
-            get_user_model()
-            .objects.filter(email=serializer.data.get("email"))
-            .first()
-        )
-
         if not user:
             return Response(
                 {"message": "Email does not exist"},
                 status=status.HTTP_400_BAD_REQUEST,
             )
 
-        user.set_password(serializer.data.get("new_password"))
+        user.set_password(serializer.data.get("password"))
         user.save()
 
         return Response(

server/api/apps/auth/reset/serializers.py …/apps/auth/reset_password/serializers.pyserver/api/apps/auth/reset/serializers.py renamed to server/api/apps/auth/reset_password/serializers.py server/api/apps/auth/reset/serializers.py renamed to server/api/apps/auth/reset_password/serializers.py

@@ -3,7 +3,7 @@
 from rest_framework.test import APITestCase
 
 
-class AuthTestCase(APITestCase):
+class RegisterTestCase(APITestCase):
     def test_get_request(self):
         """
         GIVEN: GET request to endpoint '/api/auth/register'

server/api/apps/auth/reset/urls.py …ver/api/apps/auth/reset_password/urls.pyserver/api/apps/auth/reset/urls.py renamed to server/api/apps/auth/reset_password/urls.py server/api/apps/auth/reset/urls.py renamed to server/api/apps/auth/reset_password/urls.py

@@ -0,0 +1,80 @@
+from django.contrib.auth import get_user_model
+from django.contrib.auth.tokens import PasswordResetTokenGenerator
+from django.urls import reverse
+from django.utils.encoding import force_bytes
+from django.utils.http import urlsafe_base64_encode
+from rest_framework import status
+from rest_framework.test import APITestCase
+
+
+class ResetPasswordTestCase(APITestCase):
+    def setUp(self):
+        self.testuser = get_user_model().objects.create_user(
+            email="john.doe@example.com",
+            first_name="John",
+            last_name="Doe",
+            grade="Grade 11",
+            password="password",
+        )
+        self.testuser.save()
+
+    def test_send_reset_email(self):
+        """
+        GIVEN: The endpoint '/api/auth/reset/email/' and an active user
+        WHEN: A POST request is sent to the endpoint with the HTTP body that
+            contains an email address corresponding to a valid account
+        THEN: The API HTTP Response Code should be 200
+        AND: The SMTP server will be called to send a password reset email to
+            the specified address
+        """
+        url = reverse("send-reset-email")
+        body = {"email": "john.doe@example.com"}
+
+        response = self.client.post(url, body, format="json")
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+
+    def test_verify_reset_token(self):
+        """
+        WHEN: A GET request is sent to the endpoint with uid and token as url
+            parameters
+        THEN: Returns 200 status code if the token and uid is valid
+        """
+
+        user = (
+            get_user_model()
+            .objects.filter(email="john.doe@example.com")
+            .first()
+        )
+        token = PasswordResetTokenGenerator().make_token(user)
+        uid = urlsafe_base64_encode(force_bytes(user.email))
+
+        reset_url = f"{reverse('reset')}?token={token}&uid={uid}/"
+
+        response = self.client.get(reset_url)
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+
+    def test_reset_password(self):
+        """
+        GIVEN: The endpoint '/api/auth/reset/' and a valid uid and token
+        WHEN: A PUT request is sent to the endpoint with uid and token as url
+            parameters and password in JSON body
+        THEN: Returns 200 status code if the password has been reset.
+        """
+
+        user = (
+            get_user_model()
+            .objects.filter(email="john.doe@example.com")
+            .first()
+        )
+        token = PasswordResetTokenGenerator().make_token(user)
+        uid = urlsafe_base64_encode(force_bytes(user.email))
+
+        reset_url = f"{reverse('reset')}?token={token}&uid={uid}/"
+
+        body = {"password": "123456"}
+
+        response = self.client.put(reset_url, body, format="json")
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)

server/api/apps/auth/reset/views.py …er/api/apps/auth/reset_password/views.pyserver/api/apps/auth/reset/views.py renamed to server/api/apps/auth/reset_password/views.py server/api/apps/auth/reset/views.py renamed to server/api/apps/auth/reset_password/views.py

@@ -12,5 +12,5 @@
     path("refresh/", refresh_jwt_token, name="refresh-jwt-token"),
     path("verify/", verify_jwt_token, name="verify-jwt-token"),
     path("register/", RegistrationView.as_view(), name="register"),
-    path("reset/", include("api.apps.auth.reset.urls")),
+    path("reset/", include("api.apps.auth.reset_password.urls")),
 ]