peter
19c1798f90
Replaces the single per-user DRF token with named, individually-revocable
API keys, so you can run one key per agent and cut off a leaked one without
disrupting the others.
- New ApiKey model (user, name, dbk_-prefixed key, created_at, last_used_at).
Data migration copies every existing authtoken 1:1 into a "default" named
key with the same value, so no client (incl. the sibling test project's
hardcoded test-user key) needs reconfiguring.
- Auth (resolve_token_user) resolves against ApiKey and stamps last_used_at,
throttled to one write/minute.
- Settings -> API Keys: table with name/key/created/last-used + per-row
revoke and a create form; keys viewable on demand. Settings -> Account now
links here; Settings -> Users issues a named initial key.
- Gated provisioning API for test installations: GET/POST /api/keys and
DELETE /api/keys/{id}, controlled by DAYBOOK_KEY_PROVISIONING_API (unset ->
follows DEBUG, so off in deployment). Advertised via key_provisioning_api
in /api/capabilities; 403 when disabled.
- Docs (api/deployment/quickstart/posting-helper), SKILL.md, and env.example
updated from "token / Settings -> Account" to "key / Settings -> API Keys".
- Tests: new API + UI suites for keys; existing token-based tests moved to
ApiKey. Full suite 129 passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
66 lines
2.7 KiB
Python
66 lines
2.7 KiB
Python
from django.contrib.auth import get_user_model
|
|
from django.test import TestCase
|
|
from django.urls import reverse
|
|
from artifacts.models import ApiKey
|
|
|
|
User = get_user_model()
|
|
|
|
|
|
class SettingsUsersViewTestCase(TestCase):
|
|
def setUp(self):
|
|
self.admin = User.objects.create_superuser(username="admin", password="pw", email="")
|
|
self.regular = User.objects.create_user(username="regular", password="pw")
|
|
|
|
def test_requires_login(self):
|
|
response = self.client.get(reverse("settings-users"))
|
|
self.assertEqual(response.status_code, 302)
|
|
|
|
def test_non_superuser_forbidden(self):
|
|
self.client.force_login(self.regular)
|
|
response = self.client.get(reverse("settings-users"))
|
|
self.assertEqual(response.status_code, 403)
|
|
|
|
def test_superuser_can_view(self):
|
|
self.client.force_login(self.admin)
|
|
response = self.client.get(reverse("settings-users"))
|
|
self.assertEqual(response.status_code, 200)
|
|
self.assertContains(response, "admin")
|
|
self.assertContains(response, "regular")
|
|
|
|
def test_superuser_creates_regular_user_with_token(self):
|
|
self.client.force_login(self.admin)
|
|
response = self.client.post(
|
|
reverse("settings-users"), {"username": "newtester", "password": "hunter2pw"}
|
|
)
|
|
self.assertEqual(response.status_code, 200)
|
|
|
|
created = User.objects.get(username="newtester")
|
|
self.assertTrue(created.check_password("hunter2pw"))
|
|
self.assertFalse(created.is_superuser)
|
|
self.assertFalse(created.is_staff)
|
|
self.assertTrue(ApiKey.objects.filter(user=created).exists())
|
|
self.assertContains(response, ApiKey.objects.get(user=created).key)
|
|
|
|
def test_superuser_can_grant_admin(self):
|
|
self.client.force_login(self.admin)
|
|
self.client.post(
|
|
reverse("settings-users"),
|
|
{"username": "newadmin", "password": "hunter2pw", "is_superuser": "on"},
|
|
)
|
|
created = User.objects.get(username="newadmin")
|
|
self.assertTrue(created.is_superuser)
|
|
|
|
def test_duplicate_username_rejected(self):
|
|
self.client.force_login(self.admin)
|
|
response = self.client.post(
|
|
reverse("settings-users"), {"username": "regular", "password": "hunter2pw"}
|
|
)
|
|
self.assertEqual(response.status_code, 200)
|
|
self.assertContains(response, "already exists")
|
|
self.assertEqual(User.objects.filter(username="regular").count(), 1)
|
|
|
|
def test_missing_fields_rejected(self):
|
|
self.client.force_login(self.admin)
|
|
response = self.client.post(reverse("settings-users"), {"username": "", "password": ""})
|
|
self.assertEqual(response.status_code, 200)
|
|
self.assertContains(response, "required")
|