django-database-task 0.3.0__tar.gz → 0.3.1__tar.gz

{django_database_task-0.3.0/django_database_task.egg-info → django_database_task-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-database-task
-Version: 0.3.0
+Version: 0.3.1
 Summary: A database-backed task queue backend for Django's built-in task framework
 Author-email: Shinya Okano <tokibito@gmail.com>
 Maintainer-email: Shinya Okano <tokibito@gmail.com>

{django_database_task-0.3.0 → django_database_task-0.3.1}/django_database_task/__init__.py

@@ -2,7 +2,7 @@
 django-database-task: A database-backed task queue backend for Django's task framework.
 """
 
-__version__ = "0.3.0"
+__version__ = "0.3.1"
 
 _EXECUTOR_EXPORTS = (
     "fetch_task",

{django_database_task-0.3.0 → django_database_task-0.3.1}/django_database_task/views.py

@@ -39,13 +39,78 @@ def get_backend(backend_name="default"):
     """Get a task backend by name."""
     if backend_name == "default":
         return default_task_backend
-    from django.tasks import tasks
+    from django.tasks import task_backends
 
-    return tasks[backend_name]
+    return task_backends[backend_name]
+
+
+class BackendAuthMixin:
+    """
+    Apply the authentication handler the task backend provides, if any.
+
+    The backend decides how requests are authenticated by returning a
+    handler from get_auth_handler() (see
+    DatabaseTaskBackend.get_auth_handler). A handler takes the request and
+    returns None to accept it, or a response to reject it.
+
+    The check runs in dispatch(), before the method is dispatched, so every
+    endpoint and every HTTP method is covered. Backends that provide no
+    handler are unaffected.
+    """
+
+    def get_backend_name(self, request, *args, **kwargs):
+        """
+        Name of the backend that authenticates this request.
+
+        Views that read backend_name from a request body override this.
+        """
+        return request.GET.get("backend_name", "default")
+
+    def get_auth_error_response(self, request, *args, **kwargs):
+        """Return a response if authentication fails, None if it passes."""
+        backend_name = self.get_backend_name(request, *args, **kwargs)
+        try:
+            backend = get_backend(backend_name)
+        except Exception:
+            # An unusable backend name must not skip authentication.
+            return JsonResponse({"error": "Invalid backend name"}, status=400)
+
+        get_auth_handler = getattr(backend, "get_auth_handler", None)
+        if get_auth_handler is None:
+            return None
+
+        auth_handler = get_auth_handler()
+        if auth_handler is None:
+            return None
+
+        return auth_handler(request)
+
+    def dispatch(self, request, *args, **kwargs):
+        error_response = self.get_auth_error_response(request, *args, **kwargs)
+        if error_response:
+            return error_response
+        return super().dispatch(request, *args, **kwargs)
+
+
+class JSONBodyBackendAuthMixin(BackendAuthMixin):
+    """BackendAuthMixin for views that read backend_name from a JSON body."""
+
+    def get_backend_name(self, request, *args, **kwargs):
+        try:
+            data = json.loads(request.body) if request.body else {}
+        except json.JSONDecodeError:
+            # Let the view report the malformed body.
+            return "default"
+
+        if not isinstance(data, dict):
+            return "default"
+
+        backend_name = data.get("backend_name", "default")
+        return backend_name if isinstance(backend_name, str) else "default"
 
 
 @method_decorator(csrf_exempt, name="dispatch")
-class RunTasksView(View):
+class RunTasksView(JSONBodyBackendAuthMixin, View):
     """
     Process pending tasks via HTTP POST.
 
@@ -132,7 +197,7 @@ class RunTasksView(View):
 
 
 @method_decorator(csrf_exempt, name="dispatch")
-class RunOneTaskView(View):
+class RunOneTaskView(JSONBodyBackendAuthMixin, View):
     """
     Process a single pending task via HTTP POST.
 
@@ -196,7 +261,7 @@ class RunOneTaskView(View):
         )
 
 
-class TaskStatusView(View):
+class TaskStatusView(BackendAuthMixin, View):
     """
     Get pending task count via HTTP GET.
 
@@ -225,7 +290,7 @@ class TaskStatusView(View):
 
 
 @method_decorator(csrf_exempt, name="dispatch")
-class ExecuteTaskView(View):
+class ExecuteTaskView(BackendAuthMixin, View):
     """
     Execute a specific task by ID via HTTP POST.
 
@@ -316,17 +381,6 @@ class ExecuteTaskView(View):
     http_method_names = ["post"]
 
     def post(self, request, task_id):
-        backend_name = request.GET.get("backend_name", "default")
-
-        # Get backend and check for auth handler
-        backend = get_backend(backend_name)
-        if hasattr(backend, "get_auth_handler"):
-            auth_handler = backend.get_auth_handler()
-            if auth_handler:
-                error_response = auth_handler(request)
-                if error_response:
-                    return error_response
-
         fail_on_error = request.GET.get("fail_on_error", "").lower() == "true"
         allow_retry = request.GET.get("allow_retry", "").lower() == "true"
 
@@ -364,7 +418,7 @@ class ExecuteTaskView(View):
 
 
 @method_decorator(csrf_exempt, name="dispatch")
-class PurgeCompletedTasksView(View):
+class PurgeCompletedTasksView(BackendAuthMixin, View):
     """
     Delete completed tasks via HTTP GET or POST.
 
@@ -452,17 +506,6 @@ class PurgeCompletedTasksView(View):
 
     def _purge(self, request):
         """Common purge logic for GET and POST."""
-        backend_name = request.GET.get("backend_name", "default")
-
-        # Get backend and check for auth handler
-        backend = get_backend(backend_name)
-        if hasattr(backend, "get_auth_handler"):
-            auth_handler = backend.get_auth_handler()
-            if auth_handler:
-                error_response = auth_handler(request)
-                if error_response:
-                    return error_response
-
         # Get parameters
         params, error = self._get_params(request)
         if error:

{django_database_task-0.3.0 → django_database_task-0.3.1/django_database_task.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-database-task
-Version: 0.3.0
+Version: 0.3.1
 Summary: A database-backed task queue backend for Django's built-in task framework
 Author-email: Shinya Okano <tokibito@gmail.com>
 Maintainer-email: Shinya Okano <tokibito@gmail.com>

{django_database_task-0.3.0 → django_database_task-0.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "django-database-task"
-version = "0.3.0"
+version = "0.3.1"
 description = "A database-backed task queue backend for Django's built-in task framework"
 readme = "README.md"
 license = "MIT"

{django_database_task-0.3.0 → django_database_task-0.3.1}/tests/test_views.py

@@ -3,11 +3,13 @@
 import json
 
 import pytest
+from django.http import JsonResponse
 from django.tasks.base import TaskResultStatus
 from django.test import Client
 from django.urls import reverse
 from django.utils import timezone
 
+from django_database_task.backends import DatabaseTaskBackend
 from django_database_task.models import DatabaseTask
 
 
@@ -853,3 +855,169 @@ class TestPurgeCompletedTasksView:
 
         assert response.status_code == 400
         assert "No valid statuses" in response.json()["error"]
+
+
+# All endpoints that must consult the backend's authentication handler,
+# as (url name, HTTP method, reverse() args).
+AUTHENTICATED_ENDPOINTS = [
+    ("run_tasks", "post", []),
+    ("run_one_task", "post", []),
+    ("task_status", "get", []),
+    ("execute_task", "post", ["3f2a9c11-0000-4000-8000-000000000000"]),
+    ("purge_completed_tasks", "get", []),
+    ("purge_completed_tasks", "post", []),
+]
+
+
+class AuthHandlerRecorder:
+    """An authentication handler that records the requests it saw."""
+
+    def __init__(self, response=None):
+        self.requests = []
+        self.response = response
+
+    def __call__(self, request):
+        self.requests.append(request)
+        return self.response
+
+
+@pytest.fixture
+def rejecting_handler(monkeypatch):
+    """Make the default backend reject every request with a 401."""
+    recorder = AuthHandlerRecorder(JsonResponse({"error": "Unauthorized"}, status=401))
+    monkeypatch.setattr(DatabaseTaskBackend, "get_auth_handler", lambda self: recorder)
+    return recorder
+
+
+@pytest.fixture
+def accepting_handler(monkeypatch):
+    """Make the default backend accept every request."""
+    recorder = AuthHandlerRecorder(None)
+    monkeypatch.setattr(DatabaseTaskBackend, "get_auth_handler", lambda self: recorder)
+    return recorder
+
+
+def _call(client, url_name, method, args):
+    url = reverse(f"django_database_task:{url_name}", args=args)
+    return getattr(client, method)(url, data="", content_type="application/json")
+
+
+@pytest.mark.django_db
+class TestBackendAuthentication:
+    """Tests for the authentication handler the backend provides."""
+
+    def test_base_backend_provides_no_handler(self):
+        """The base backend opts out of authentication."""
+        assert (
+            DatabaseTaskBackend(alias="default", params={}).get_auth_handler() is None
+        )
+
+    @pytest.mark.parametrize("url_name,method,args", AUTHENTICATED_ENDPOINTS)
+    def test_rejected_request_is_blocked(
+        self, client, rejecting_handler, url_name, method, args
+    ):
+        """Every endpoint returns the handler's response and stops there."""
+        response = _call(client, url_name, method, args)
+
+        assert response.status_code == 401
+        assert response.json() == {"error": "Unauthorized"}
+        assert len(rejecting_handler.requests) == 1
+
+    @pytest.mark.parametrize("url_name,method,args", AUTHENTICATED_ENDPOINTS)
+    def test_accepted_request_reaches_the_view(
+        self, client, accepting_handler, url_name, method, args
+    ):
+        """A handler returning None lets the request through."""
+        response = _call(client, url_name, method, args)
+
+        assert len(accepting_handler.requests) == 1
+        assert response.status_code != 401
+
+    @pytest.mark.parametrize("url_name,method,args", AUTHENTICATED_ENDPOINTS)
+    def test_endpoints_work_without_a_handler(self, client, url_name, method, args):
+        """Backends without a handler are unaffected."""
+        response = _call(client, url_name, method, args)
+
+        assert response.status_code != 401
+
+    def test_rejected_request_does_not_run_tasks(self, client, rejecting_handler):
+        """A blocked run request leaves the queued task alone."""
+        task = DatabaseTask.objects.create(
+            task_path="tests.test_executor.sample_task",
+            queue_name="default",
+            priority=0,
+            args_json=[],
+            kwargs_json={},
+            status=TaskResultStatus.READY,
+            enqueued_at=timezone.now(),
+            backend_name="default",
+        )
+
+        response = client.post(reverse("django_database_task:run_tasks"))
+
+        assert response.status_code == 401
+        task.refresh_from_db()
+        assert task.status == TaskResultStatus.READY
+
+    def test_rejected_request_does_not_purge_tasks(self, client, rejecting_handler):
+        """A blocked purge request deletes nothing."""
+        DatabaseTask.objects.create(
+            task_path="tests.test_executor.sample_task",
+            queue_name="default",
+            priority=0,
+            args_json=[],
+            kwargs_json={},
+            status=TaskResultStatus.SUCCESSFUL,
+            enqueued_at=timezone.now(),
+            finished_at=timezone.now(),
+            backend_name="default",
+        )
+
+        response = client.post(reverse("django_database_task:purge_completed_tasks"))
+
+        assert response.status_code == 401
+        assert DatabaseTask.objects.count() == 1
+
+    def test_unusable_backend_name_does_not_skip_authentication(
+        self, client, rejecting_handler
+    ):
+        """An unresolvable backend is rejected instead of running unauthenticated."""
+        response = client.get(
+            reverse("django_database_task:task_status"),
+            {"backend_name": "does-not-exist"},
+        )
+
+        assert response.status_code == 400
+        assert response.json() == {"error": "Invalid backend name"}
+        assert rejecting_handler.requests == []
+
+    def test_backend_name_from_the_request_body_is_used(self, client, monkeypatch):
+        """Views that read backend_name from a JSON body authenticate with it."""
+        seen = []
+        monkeypatch.setattr(
+            DatabaseTaskBackend,
+            "get_auth_handler",
+            lambda self: lambda request: seen.append(request) or None,
+        )
+
+        response = client.post(
+            reverse("django_database_task:run_tasks"),
+            data=json.dumps({"backend_name": "default"}),
+            content_type="application/json",
+        )
+
+        assert response.status_code == 200
+        assert len(seen) == 1
+
+    def test_malformed_body_still_reports_a_bad_request(
+        self, client, accepting_handler
+    ):
+        """A broken JSON body is reported by the view, not the auth check."""
+        response = client.post(
+            reverse("django_database_task:run_tasks"),
+            data="{not json",
+            content_type="application/json",
+        )
+
+        assert response.status_code == 400
+        assert "Invalid JSON" in response.json()["error"]