ntc-dev-kit 1.2.0__tar.gz → 1.2.1__tar.gz

{ntc_dev_kit-1.2.0/ntc_dev_kit.egg-info → ntc_dev_kit-1.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ntc-dev-kit
-Version: 1.2.0
+Version: 1.2.1
 Summary: Nexent Toolkit Console - A CLI tool for scaffolding Django REST Framework, React, Next.js, and Flutter projects
 Home-page: https://github.com/nexent/ntc
 Author: Nexent

{ntc_dev_kit-1.2.0 → ntc_dev_kit-1.2.1}/ntc/__init__.py

@@ -1,5 +1,5 @@
 """NTC - Nexent Toolkit Console."""
 
-__version__ = "1.2.0"
+__version__ = "1.2.1"
 __author__ = "Nexent"
 __license__ = "MIT"

{ntc_dev_kit-1.2.0 → ntc_dev_kit-1.2.1}/ntc/templates/auth_app/migrations/0001_initial.py

@@ -1,7 +1,8 @@
-# Generated by Django 5.2.7 on 2026-10-20 14:53
+# Generated by Django 5.2.7 on 2026-10-20 16:26
 
-import django.contrib.auth.models
+import apps.authentication.models
 import django.contrib.auth.validators
+import django.db.models.functions.text
 import django.utils.timezone
 from django.db import migrations, models
 
@@ -23,12 +24,12 @@ class Migration(migrations.Migration):
                 ('last_login', models.DateTimeField(blank=True, null=True, verbose_name='last login')),
                 ('is_superuser', models.BooleanField(default=False, help_text='Designates that this user has all permissions without explicitly assigning them.', verbose_name='superuser status')),
                 ('username', models.CharField(error_messages={'unique': 'A user with that username already exists.'}, help_text='Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.', max_length=150, unique=True, validators=[django.contrib.auth.validators.UnicodeUsernameValidator()], verbose_name='username')),
+                ('first_name', models.CharField(blank=True, max_length=150, verbose_name='first name')),
+                ('last_name', models.CharField(blank=True, max_length=150, verbose_name='last name')),
                 ('is_staff', models.BooleanField(default=False, help_text='Designates whether the user can log into this admin site.', verbose_name='staff status')),
                 ('is_active', models.BooleanField(default=True, help_text='Designates whether this user should be treated as active. Unselect this instead of deleting accounts.', verbose_name='active')),
                 ('date_joined', models.DateTimeField(default=django.utils.timezone.now, verbose_name='date joined')),
                 ('email', models.EmailField(max_length=254, unique=True)),
-                ('first_name', models.CharField(blank=True, max_length=30)),
-                ('last_name', models.CharField(blank=True, max_length=30)),
                 ('phone_number', models.CharField(blank=True, max_length=15)),
                 ('date_of_birth', models.DateField(blank=True, null=True)),
                 ('profile_picture', models.ImageField(blank=True, null=True, upload_to='profile_pics/')),
@@ -41,10 +42,10 @@ class Migration(migrations.Migration):
             options={
                 'verbose_name': 'User',
                 'verbose_name_plural': 'Users',
-                'db_table': 'auth_user',
+                'constraints': [models.UniqueConstraint(django.db.models.functions.text.Lower('email'), name='authentication_user_email_ci_unique')],
             },
             managers=[
-                ('objects', django.contrib.auth.models.UserManager()),
+                ('objects', apps.authentication.models.UserManager()),
             ],
         ),
     ]

ntc_dev_kit-1.2.1/ntc/templates/auth_app/models.py

@@ -0,0 +1,54 @@
+from django.contrib.auth.models import AbstractUser, UserManager as DjangoUserManager
+from django.db import models
+from django.db.models.functions import Lower
+
+
+def normalize_email(email):
+    """Emails are stored lowercase: A@x.com and a@x.com are the same person, and sign-in and
+    password resets look them up exactly."""
+    return (email or '').strip().lower()
+
+
+class UserManager(DjangoUserManager):
+    def _create_user(self, username, email, password, **extra_fields):
+        return super()._create_user(username, normalize_email(email), password, **extra_fields)
+
+    def get_by_natural_key(self, username):
+        # USERNAME_FIELD is the email: sign-in matches it whatever the case typed.
+        return self.get(email=normalize_email(username))
+
+
+class User(AbstractUser):
+    """Custom User model extending AbstractUser. first_name/last_name keep AbstractUser's 150 characters."""
+    email = models.EmailField(unique=True)
+    phone_number = models.CharField(max_length=15, blank=True)
+    date_of_birth = models.DateField(null=True, blank=True)
+    # Stored in R2 when it's configured (STORAGES in settings), on disk in development.
+    profile_picture = models.ImageField(upload_to='profile_pics/', null=True, blank=True)
+    is_verified = models.BooleanField(default=False)
+    created_at = models.DateTimeField(auto_now_add=True)
+    updated_at = models.DateTimeField(auto_now=True)
+
+    objects = UserManager()
+
+    USERNAME_FIELD = 'email'
+    REQUIRED_FIELDS = ['username']
+
+    class Meta:
+        verbose_name = 'User'
+        verbose_name_plural = 'Users'
+        constraints = [
+            # Belt and braces with the lowercase normalization: no two accounts differ only by case.
+            models.UniqueConstraint(Lower('email'), name='authentication_user_email_ci_unique'),
+        ]
+
+    def save(self, *args, **kwargs):
+        self.email = normalize_email(self.email)
+        super().save(*args, **kwargs)
+
+    def __str__(self):
+        return self.email
+
+    @property
+    def full_name(self) -> str:
+        return f"{self.first_name} {self.last_name}".strip()

{ntc_dev_kit-1.2.0 → ntc_dev_kit-1.2.1}/ntc/templates/auth_app/serializers.py

@@ -1,7 +1,7 @@
 from rest_framework import serializers
 from django.contrib.auth import authenticate
 from django.contrib.auth.password_validation import validate_password
-from .models import User
+from .models import User, normalize_email
 
 
 class UserRegistrationSerializer(serializers.ModelSerializer):
@@ -13,6 +13,13 @@ class UserRegistrationSerializer(serializers.ModelSerializer):
         model = User
         fields = ('email', 'username', 'password', 'password_confirm', 'first_name', 'last_name')
 
+    def validate_email(self, value):
+        # Case-insensitive, like the database constraint: A@x.com is already taken by a@x.com.
+        value = normalize_email(value)
+        if User.objects.filter(email=value).exists():
+            raise serializers.ValidationError('An account with this email already exists.')
+        return value
+
     def validate(self, attrs):
         if attrs['password'] != attrs['password_confirm']:
             raise serializers.ValidationError({'password_confirm': "Passwords don't match."})

ntc_dev_kit-1.2.1/ntc/templates/auth_app/tasks.py

@@ -0,0 +1,28 @@
+import logging
+
+from celery import shared_task
+
+from core.services.azure.email.notifier import send_template_email
+from .models import User
+
+logger = logging.getLogger(__name__)
+
+
+@shared_task(bind=True, max_retries=3, default_retry_delay=60)
+def send_password_reset_email(self, user_id, reset_url):
+    """The password-reset email, sent by a worker so the request never waits on the mail server.
+    Retried a few times if sending fails (the link stays valid for PASSWORD_RESET_TIMEOUT)."""
+    user = User.objects.filter(pk=user_id, is_active=True).first()
+    if user is None:
+        return
+    try:
+        send_template_email(
+            subject='Reset your password',
+            to=user.email,
+            template='authentication/password_reset',
+            context={'user': user, 'reset_url': reset_url},
+            sender='no_reply',
+        )
+    except Exception as exc:  # noqa: BLE001 - any mail failure: try again later
+        logger.warning('Password reset email to user %s failed: %s', user_id, exc)
+        raise self.retry(exc=exc)

ntc_dev_kit-1.2.1/ntc/templates/auth_app/templates/authentication/password_reset.html

@@ -0,0 +1,5 @@
+<p>Hi {{ user.first_name|default:user.email }},</p>
+<p>Someone asked to reset the password for your account. If it was you, choose a new password here:</p>
+<p><a href="{{ reset_url }}">Choose a new password</a></p>
+<p>The link works once and expires in a few days. If you didn't ask for this, ignore this email - your
+password stays as it is.</p>

ntc_dev_kit-1.2.1/ntc/templates/auth_app/templates/authentication/password_reset.txt

@@ -0,0 +1,9 @@
+{% autoescape off %}{# plain text: no HTML escaping, or the link shows & #}Hi {{ user.first_name|default:user.email }},
+
+Someone asked to reset the password for your account. If it was you, choose a new password here:
+
+{{ reset_url }}
+
+The link works once and expires in a few days. If you didn't ask for this, ignore this email - your
+password stays as it is.
+{% endautoescape %}

{ntc_dev_kit-1.2.0 → ntc_dev_kit-1.2.1}/ntc/templates/auth_app/tests.py

@@ -104,3 +104,54 @@ def test_sign_in_is_rate_limited_with_a_readable_429(client, user, monkeypatch):
     assert response.status_code == 429
     assert response.data['code'] == 'throttled'
     assert 'Retry-After' in response
+
+
+def test_the_client_gets_the_session_inside_the_envelope(client, user):
+    body = login(client).json()
+    assert body['status'] == 'success'
+    assert body['data']['access']
+    assert body['data']['user']['email'] == 'ada@example.com'
+
+
+def test_email_is_case_insensitive(client, user):
+    response = client.post('/api/v1/auth/register/', {
+        'email': ' ADA@Example.com', 'username': 'ada2', 'password': PASSWORD, 'password_confirm': PASSWORD,
+    }, format='json')
+    assert response.status_code == 400
+    assert 'email' in response.json()['errors']
+    signed_in = client.post('/api/v1/auth/login/', {'email': 'Ada@EXAMPLE.com', 'password': PASSWORD}, format='json')
+    assert signed_in.status_code == 200
+
+
+def test_registration_stores_the_email_lowercase(client, db):
+    client.post('/api/v1/auth/register/', {
+        'email': 'Grace@Example.com', 'username': 'grace', 'password': PASSWORD, 'password_confirm': PASSWORD,
+    }, format='json')
+    assert User.objects.filter(email='grace@example.com').exists()
+
+
+def test_changing_the_password_signs_out_other_sessions_but_not_this_one(client, user):
+    other_device = login(APIClient()).cookies[settings.AUTH_REFRESH_COOKIE].value
+    access = login(client).data['access']
+    client.credentials(HTTP_AUTHORIZATION=f'Bearer {access}')
+    new_password = PASSWORD + '-new'
+    response = client.post('/api/v1/auth/change-password/', {
+        'old_password': PASSWORD, 'new_password': new_password, 'new_password_confirm': new_password,
+    }, format='json')
+    assert response.status_code == 200
+    assert response.data['access']  # this device stays signed in, with a fresh session
+    client.credentials()
+    assert client.post('/api/v1/auth/refresh/').status_code == 200
+    stolen = APIClient().post('/api/v1/auth/refresh/', {'refresh': other_device}, format='json')
+    assert stolen.status_code == 401
+
+
+def test_resetting_the_password_signs_out_every_session(client, user):
+    old_session = login(APIClient()).cookies[settings.AUTH_REFRESH_COOKIE].value
+    client.post('/api/v1/auth/reset-password/', {'email': 'ada@example.com'}, format='json')
+    uid, token = re.search(r'uid=([^&\s]+)&token=([^\s]+)', mail.outbox[0].body).groups()
+    new_password = PASSWORD + '-new'
+    client.post('/api/v1/auth/reset-password-confirm/', {
+        'uid': uid, 'token': token, 'new_password': new_password, 'new_password_confirm': new_password,
+    }, format='json')
+    assert client.post('/api/v1/auth/refresh/', {'refresh': old_session}, format='json').status_code == 401

{ntc_dev_kit-1.2.0 → ntc_dev_kit-1.2.1}/ntc/templates/auth_app/views.py

@@ -1,7 +1,8 @@
+import logging
+
 from django.conf import settings
 from django.contrib.auth.models import update_last_login
 from django.contrib.auth.tokens import default_token_generator
-from django.core.mail import send_mail
 from django.utils.encoding import force_bytes, force_str
 from django.utils.http import urlsafe_base64_decode, urlsafe_base64_encode
 from drf_spectacular.utils import extend_schema, inline_serializer
@@ -16,11 +17,14 @@ from rest_framework_simplejwt.tokens import RefreshToken
 
 from core.response_wrapper import error_response
 from .models import User
+from .tasks import send_password_reset_email
 from .serializers import (
     ChangePasswordSerializer, ResetPasswordConfirmSerializer, ResetPasswordSerializer,
     UpdateProfileSerializer, UserLoginSerializer, UserProfileSerializer, UserRegistrationSerializer,
 )
 
+logger = logging.getLogger(__name__)
+
 
 class AuthRateThrottle(AnonRateThrottle):
     """Anonymous sign-in, registration and reset attempts per IP (THROTTLE_AUTH): against password guessing."""
@@ -162,16 +166,26 @@ def update_profile(request):
     }, status=status.HTTP_200_OK)
 
 
-@extend_schema(request=ChangePasswordSerializer, responses=MessageSerializer)
+def revoke_all_sessions(user):
+    """Blacklist every refresh token the user has, so each session ends at its next refresh. Called
+    when the password changes: a stolen refresh token must not outlive the password it came with."""
+    from rest_framework_simplejwt.token_blacklist.models import BlacklistedToken, OutstandingToken
+    tokens = OutstandingToken.objects.filter(user=user).exclude(blacklistedtoken__isnull=False)
+    BlacklistedToken.objects.bulk_create([BlacklistedToken(token=t) for t in tokens], ignore_conflicts=True)
+
+
+@extend_schema(request=ChangePasswordSerializer, responses=SessionSerializer)
 @api_view(['POST'])
 @permission_classes([IsAuthenticated])
 def change_password(request):
-    """Change the password, given the current one."""
+    """Change the password, given the current one. Every other session is signed out; this one gets
+    a fresh session so the user stays signed in here."""
     serializer = ChangePasswordSerializer(data=request.data, context={'request': request})
     serializer.is_valid(raise_exception=True)
     request.user.set_password(serializer.validated_data['new_password'])
     request.user.save(update_fields=['password'])
-    return Response({'message': 'Password changed successfully'}, status=status.HTTP_200_OK)
+    revoke_all_sessions(request.user)
+    return _session(request.user, 'Password changed successfully')
 
 
 @extend_schema(request=ResetPasswordSerializer, responses=MessageSerializer)
@@ -188,13 +202,12 @@ def reset_password(request):
         uid = urlsafe_base64_encode(force_bytes(user.pk))
         token = default_token_generator.make_token(user)
         reset_url = f"{settings.FRONTEND_URL}/reset-password-confirm?uid={uid}&token={token}"
-        send_mail(
-            'Password Reset Request',
-            f'Click the link to reset your password: {reset_url}',
-            settings.DEFAULT_FROM_EMAIL,
-            [user.email],
-            fail_silently=False,
-        )
+        # Sent by a worker (tasks.py): the request doesn't wait on the mail server, and neither a
+        # mail outage nor an unreachable queue turns this into a 500 - the answer is the same either way.
+        try:
+            send_password_reset_email.delay(user.pk, reset_url)
+        except Exception:  # noqa: BLE001
+            logger.exception('Could not queue the password reset email for user %s', user.pk)
     return Response({'message': 'If that email has an account, a reset link is on its way.'},
                     status=status.HTTP_200_OK)
 
@@ -215,4 +228,5 @@ def reset_password_confirm(request):
         return error_response('This link is invalid or has expired. Please request a new one.', 400)
     user.set_password(serializer.validated_data['new_password'])
     user.save(update_fields=['password'])
+    revoke_all_sessions(user)  # whoever had the old password is signed out everywhere
     return Response({'message': 'Password reset successful'}, status=status.HTTP_200_OK)

{ntc_dev_kit-1.2.0 → ntc_dev_kit-1.2.1}/ntc/templates/drf_structure/main.py

@@ -293,7 +293,9 @@ def get_pip_path(env_dir):
         
 # The initial migration ships with the app, so a new project's first `migrate` creates the users
 # table - no makemigrations step to know about.
-AUTH_APP_FILES = ('apps.py', 'models.py', 'serializers.py', 'views.py', 'urls.py', 'admin.py', 'tests.py',
+AUTH_APP_FILES = ('apps.py', 'models.py', 'serializers.py', 'views.py', 'urls.py', 'admin.py', 'tests.py', 'tasks.py',
+                  os.path.join('templates', 'authentication', 'password_reset.html'),
+                  os.path.join('templates', 'authentication', 'password_reset.txt'),
                   os.path.join('migrations', '0001_initial.py'))
 
 
@@ -335,7 +337,9 @@ def _write_auth_app(project_root):
             raise FileNotFoundError(f"Authentication template missing: {source}")
         with open(source, "r", encoding="utf-8") as f:
             content = f.read()
-        with open(os.path.join(app_dir, name), "w", encoding="utf-8") as f:
+        destination = os.path.join(app_dir, name)
+        os.makedirs(os.path.dirname(destination), exist_ok=True)
+        with open(destination, "w", encoding="utf-8") as f:
             f.write(content)
 
 

{ntc_dev_kit-1.2.0 → ntc_dev_kit-1.2.1}/ntc/templates/drf_structure/structure.json

@@ -23,6 +23,16 @@
   "ruff.toml": {
     "template": "templates/root/ruff_toml.txt"
   },
+  ".pre-commit-config.yaml": {
+    "template": "templates/ci/pre_commit.yaml"
+  },
+  ".github": {
+    "workflows": {
+      "ci.yml": {
+        "template": "templates/ci/github_ci.yml"
+      }
+    }
+  },
   "CLAUDE.md": {
     "template": "templates/CLAUDE.md"
   },
@@ -83,6 +93,9 @@
       },
       "tests": {
         "__init__.py": ""
+      },
+      "checks.py": {
+        "template": "templates/apps/common_checks.py"
       }
     }
   },
@@ -162,6 +175,18 @@
       "logger.py": {
         "template": "templates/core/logger.py"
       }
+    },
+    "renderers.py": {
+      "template": "templates/core/renderers.py"
+    },
+    "schema.py": {
+      "template": "templates/core/schema.py"
+    },
+    "health.py": {
+      "template": "templates/core/health.py"
+    },
+    "tests.py": {
+      "template": "templates/core/tests.py"
     }
   },
   "{project_name}": {
@@ -199,4 +224,4 @@
       }
     }
   }
-}
+}

{ntc_dev_kit-1.2.0 → ntc_dev_kit-1.2.1}/ntc/templates/drf_structure/templates/.entry/start_tasks_backend.sh

@@ -9,7 +9,8 @@ QUEUES="${CELERY_QUEUES:-default}"
 echo "Starting Celery worker (queues: $QUEUES) and beat..."
 celery -A {project_name} worker -l INFO -Q "$QUEUES" --concurrency "${CELERY_CONCURRENCY:-2}" &
 WORKER_PID=$!
-celery -A {project_name} beat -l INFO --schedule /tmp/celerybeat-schedule &
+# The schedule is in the database (CELERY_BEAT_SCHEDULER in settings: django_celery_beat).
+celery -A {project_name} beat -l INFO &
 BEAT_PID=$!
 
 shutdown() {

{ntc_dev_kit-1.2.0 → ntc_dev_kit-1.2.1}/ntc/templates/drf_structure/templates/CLAUDE.md

@@ -168,7 +168,7 @@ from core.services.object_storage import ObjectStorageService
 return success_response(data={"id": 123}, message="Created successfully")
 
 # Error response
-return error_response(message="Invalid input", code=400)
+return error_response(message="Invalid input", status=400)
 
 # Send email
 send_template_email(
@@ -195,3 +195,21 @@ public_url, key = storage.upload_file(uploaded_file, "path/to/file")
 
 **Last Updated**: 2026-05-09
 **Template Version**: Enhanced with Docker, Azure Email, Sentry, and R2 Storage
+
+## API conventions and built-ins
+
+- **One response shape.** Every success is `{"status": "success", "message", "data"}` - a plain `Response(data)`,
+  serializer data and paginated lists included (`core/renderers.py`). Errors are
+  `{"status": "error", "message", "code"?, "errors"?}` (`core/exceptions/handler.py`). In both helpers `status=` is
+  the HTTP status; `code=` is only the machine-readable reason in an error body.
+- **Health check:** `GET /api/v1/health/` - database and Redis reachability, for the platform's probe.
+- **API docs:** `/api/v1/docs/` is public in development only; in production staff sign in at `/admin/` first, or set
+  `API_DOCS_PUBLIC=True`.
+- **Uploaded files** (`FileField`/`ImageField`) go to R2 once the `R2_*` variables are set (`STORAGES`); without them
+  they are kept on the server's disk and `manage.py check` warns (they would be lost on redeploy).
+- **Email:** send with `core.services.azure.email.notifier.send_template_email` from a Celery task (see
+  `apps/authentication/tasks.py`), never inside the request.
+- **Periodic jobs:** `CELERY_BEAT_SCHEDULE` is loaded into the database scheduler (`django_celery_beat`); jobs can also
+  be added or paused in the admin.
+- **Checks:** `ruff check .`, `pytest`, `python manage.py makemigrations --check` - the same as CI
+  (`.github/workflows/ci.yml`) and the pre-commit hook.

{ntc_dev_kit-1.2.0 → ntc_dev_kit-1.2.1}/ntc/templates/drf_structure/templates/apps/common_apps.py

@@ -4,3 +4,6 @@ from django.apps import AppConfig
 class CommonConfig(AppConfig):
     default_auto_field = 'django.db.models.BigAutoField'
     name = 'apps.common'
+
+    def ready(self):
+        from . import checks  # noqa: F401  (registers the system checks)

ntc_dev_kit-1.2.1/ntc/templates/drf_structure/templates/apps/common_checks.py

@@ -0,0 +1,17 @@
+"""System checks that run on `manage.py check`, `migrate` and at startup."""
+from django.conf import settings
+from django.core.checks import Warning, register
+
+
+@register()
+def media_storage(app_configs, **kwargs):
+    """Uploaded files (e.g. profile pictures) need R2 outside development: a container's own disk is
+    wiped on every deploy, isn't shared between instances, and nginx doesn't serve /media/."""
+    if settings.DEBUG or settings.MEDIA_IN_R2:
+        return []
+    return [Warning(
+        'Uploaded files are being stored on this server\'s disk.',
+        hint='Set R2_ACCOUNT_ID (or R2_ENDPOINT), R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, R2_BUCKET and '
+             'R2_PUBLIC_BASE_URL, or uploads will be lost on the next deploy and return 404 meanwhile.',
+        id='common.W001',
+    )]

ntc_dev_kit-1.2.1/ntc/templates/drf_structure/templates/ci/github_ci.yml

@@ -0,0 +1,28 @@
+# Lint, tests and Django's checks on every push and pull request.
+name: CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    env:
+      DJANGO_SETTINGS_MODULE: {project_name}.settings.test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: requirements*.txt
+      - run: pip install -r requirements-dev.txt
+      - name: Lint
+        run: ruff check .
+      - name: Django checks
+        run: python manage.py check
+      - name: Migrations are up to date
+        run: python manage.py makemigrations --check --dry-run
+      - name: Tests
+        run: pytest

ntc_dev_kit-1.2.1/ntc/templates/drf_structure/templates/ci/pre_commit.yaml

@@ -0,0 +1,7 @@
+# pip install pre-commit && pre-commit install - then ruff runs on the files in every commit.
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.8.4
+    hooks:
+      - id: ruff
+        args: [--fix]

{ntc_dev_kit-1.2.0 → ntc_dev_kit-1.2.1}/ntc/templates/drf_structure/templates/core/exceptions/handler.py

@@ -17,9 +17,8 @@ def exception_handler(exc, context):
         response = error_response(
             f'Too many attempts. Please wait {wait} seconds and try again.' if wait
             else 'Too many attempts. Please try again shortly.',
-            429,
+            status=429, code='throttled',
         )
-        response.data['code'] = 'throttled'
         if wait:
             response['Retry-After'] = str(wait)
         return response
@@ -30,13 +29,11 @@ def exception_handler(exc, context):
 
     data = response.data
     if isinstance(data, dict) and set(data) == {'detail'}:
-        wrapped = error_response(str(data['detail']), response.status_code)
-        code = getattr(data['detail'], 'code', None)
-        if code:
-            wrapped.data['code'] = code
+        wrapped = error_response(str(data['detail']), status=response.status_code,
+                                 code=getattr(data['detail'], 'code', None))
     else:
-        wrapped = error_response('Please check the highlighted fields.', response.status_code, errors=data)
-        wrapped.data['code'] = 'validation_error'
+        wrapped = error_response('Please check the highlighted fields.', status=response.status_code,
+                                 errors=data, code='validation_error')
     for header, value in response.items():  # keep WWW-Authenticate, Allow, ...
         wrapped[header] = value
     return wrapped

ntc_dev_kit-1.2.1/ntc/templates/drf_structure/templates/core/health.py

@@ -0,0 +1,68 @@
+"""GET /api/v1/health/ - can the backend reach its database and Redis?
+
+200 when both answer, 503 otherwise, with a plain reason per service (wrong password, host not found,
+timed out...). For the platform's health check and uptime monitors. It names no hosts, ports or
+credentials, so it is safe to leave public.
+"""
+import socket
+
+import redis
+from django.conf import settings
+from django.db import connection
+from drf_spectacular.utils import extend_schema, inline_serializer
+from rest_framework import serializers
+from rest_framework.decorators import api_view, authentication_classes, permission_classes, throttle_classes
+from rest_framework.permissions import AllowAny
+
+from core.response_wrapper import error_response, success_response
+
+ServiceSerializer = inline_serializer('HealthService', {'ok': serializers.BooleanField(),
+                                                        'problem': serializers.CharField(allow_blank=True)})
+
+
+def _database():
+    try:
+        with connection.cursor() as cursor:
+            cursor.execute('SELECT 1')
+        return {'ok': True, 'problem': ''}
+    except Exception as exc:  # noqa: BLE001
+        return {'ok': False, 'problem': f'cannot query the database ({type(exc).__name__})'}
+
+
+def _redis():
+    try:
+        redis.Redis.from_url(settings.REDIS_URL, socket_connect_timeout=3, socket_timeout=3).ping()
+        return {'ok': True, 'problem': ''}
+    except redis.exceptions.AuthenticationError:
+        problem = 'Redis refused the user or password (check REDIS_USER and REDIS_PASSWORD)'
+    except redis.exceptions.ResponseError as exc:
+        problem = 'Redis needs a password (set REDIS_PASSWORD)' if 'NOAUTH' in str(exc) else 'Redis answered with an error'
+    except redis.exceptions.TimeoutError:
+        problem = 'timed out: nothing answered at REDIS_HOST:REDIS_PORT'
+    except redis.exceptions.ConnectionError as exc:
+        text = str(exc)
+        if isinstance(exc.__context__, socket.gaierror) or 'getaddrinfo' in text or 'Name or service not known' in text:
+            problem = 'host name not found (check REDIS_HOST)'
+        elif 'refused' in text.lower():
+            problem = 'connection refused (check REDIS_HOST and REDIS_PORT)'
+        else:
+            problem = 'cannot connect'
+    except Exception as exc:  # noqa: BLE001
+        problem = f'unexpected error ({type(exc).__name__})'
+    return {'ok': False, 'problem': problem}
+
+
+@extend_schema(responses=inline_serializer('Health', {'ok': serializers.BooleanField(),
+                                                       'database': ServiceSerializer, 'redis': ServiceSerializer}),
+               auth=[])
+@api_view(['GET'])
+@authentication_classes([])
+@permission_classes([AllowAny])
+@throttle_classes([])
+def health(request):
+    """Database and Redis reachability, for deploy checks and uptime monitors."""
+    data = {'database': _database(), 'redis': _redis()}
+    data['ok'] = data['database']['ok'] and data['redis']['ok']
+    if data['ok']:
+        return success_response(data, 'Healthy')
+    return error_response('The backend cannot reach a service it needs.', status=503, errors=data, code='unhealthy')

ntc_dev_kit-1.2.1/ntc/templates/drf_structure/templates/core/renderers.py

@@ -0,0 +1,15 @@
+from rest_framework.renderers import JSONRenderer
+
+
+class EnvelopeJSONRenderer(JSONRenderer):
+    """Wraps every successful response as {"status": "success", "message": ..., "data": ...}, the shape
+    success_response produces, so a plain Response(...), a serializer's data and a paginated list all
+    reach the client in one format. Responses already built by success_response / error_response (or
+    the exception handler) are marked `_enveloped` and pass through untouched."""
+
+    def render(self, data, accepted_media_type=None, renderer_context=None):
+        response = (renderer_context or {}).get('response')
+        if response is not None and not getattr(response, '_enveloped', False) and response.status_code < 400:
+            if response.status_code != 204:
+                data = {'status': 'success', 'message': 'Success', 'data': data}
+        return super().render(data, accepted_media_type, renderer_context)

ntc_dev_kit-1.2.1/ntc/templates/drf_structure/templates/core/response_wrapper.py

@@ -0,0 +1,27 @@
+"""The API's one response shape.
+
+    success: {"status": "success", "message": str, "data": ...}
+    error:   {"status": "error", "message": str, "code"?: str, "errors"?: {...}}
+
+`status=` is always the HTTP status; `code=` is always the short machine-readable reason in the body
+(e.g. "throttled", "validation_error"). A plain Response(...) gets the success shape from
+core.renderers.EnvelopeJSONRenderer, so these helpers are for setting the message or the status.
+"""
+from rest_framework.response import Response
+
+
+def success_response(data=None, message='Success', status=200):
+    response = Response({'status': 'success', 'message': message, 'data': data}, status=status)
+    response._enveloped = True
+    return response
+
+
+def error_response(message='Error', status=400, errors=None, code=None):
+    body = {'status': 'error', 'message': message}
+    if code is not None:
+        body['code'] = code
+    if errors is not None:
+        body['errors'] = errors
+    response = Response(body, status=status)
+    response._enveloped = True
+    return response