ntc-dev-kit 1.2.0__tar.gz → 1.3.0__tar.gz

{ntc_dev_kit-1.2.0/ntc_dev_kit.egg-info → ntc_dev_kit-1.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ntc-dev-kit
-Version: 1.2.0
+Version: 1.3.0
 Summary: Nexent Toolkit Console - A CLI tool for scaffolding Django REST Framework, React, Next.js, and Flutter projects
 Home-page: https://github.com/nexent/ntc
 Author: Nexent
@@ -27,6 +27,7 @@ License-File: LICENSE
 Requires-Dist: colorama>=0.4.6
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: textual>=0.47.0
+Requires-Dist: tomli>=2.0; python_version < "3.11"
 Provides-Extra: dev
 Requires-Dist: build>=1.0; extra == "dev"
 Requires-Dist: twine>=4.0; extra == "dev"
@@ -121,7 +122,85 @@ ntc init -t nextjs --name site --install --yes
 | `--with-auth` / `--no-auth` | Django: include the sign-in app (custom User model, JWT, migration included) |
 | `--env` | Django: `venv`, `conda`, `existing` (the active virtualenv) or `skip` |
 | `--install` / `--no-install` | Others: run `npm install` / `flutter pub get` |
-| `--yes`, `-y` | Ask nothing; needs `--name` and `--technology` |
+| `--apps` | A workspace instead of one app: `backend,website,dashboard,admin,mobile` (any of them) |
+| `--git` | Workspace: `per-app` (default), `single` or `none` |
+| `--yes`, `-y` | Ask nothing; needs `--name` and `--technology` (or `--apps`) |
+
+### Workspaces: several apps at once
+
+Tick more than one app at **What are you building?** (Space ticks) - say a backend, a website and
+an admin dashboard - and they're created side by side in one folder, already connected:
+
+- each app gets its own port, the frontends point at the backend's API, and the backend allows
+  the frontends' origins (CORS);
+- dependencies install for all apps at once, one line each;
+- git: a repository per app (plus a small one at the root for `ntc.toml`), one for everything,
+  or none;
+- `ntc.toml` at the root says how each app is set up and run.
+
+```
+kaya/
+├── ntc.toml        # the apps, their ports, setup and run commands, env
+├── README.md
+├── backend/        # Django REST API   http://127.0.0.1:8000
+├── website/        # Next.js           http://127.0.0.1:3000
+└── admin/          # React admin       http://127.0.0.1:5173
+```
+
+Then, from anywhere inside the workspace:
+
+```bash
+ntc start                  # every app in this terminal: a tab each plus "All"
+ntc start backend admin    # just these (and what they need)
+ntc start --plain          # interleaved output instead (CI, logs)
+ntc setup                  # environments, .env files, dependencies - after a clone or a deep clean
+ntc clean                  # build output and caches; shows the space freed
+ntc clean --deep           # also node_modules and Python environments
+ntc add                    # another app, wired in like the rest
+```
+
+In `ntc start`: **1-9** (or the tabs) switch app, **0** shows all, **r** restarts, **s** stops or
+starts, **o** opens it in the browser, **i** types into it (Flutter's `r` hot reload), **q** quits
+and stops everything. Apps wait for the ones they `need` (the backend) before starting, and a port
+that's already taken is reported instead of crashing.
+
+`ntc clean` only removes what the tools rebuild (`.next`, `dist`, `__pycache__`, caches; with
+`--deep` also `node_modules` and `env`), never anything git tracks, and skips apps that are running.
+`--dry-run` shows what would go.
+
+`ntc.toml` is plain TOML and meant to be edited and committed (no secrets in it - those stay in
+each app's `.env`):
+
+```toml
+name = "kaya"
+
+[apps.backend]
+kind = "django"
+path = "backend"
+port = 8000
+python = "env"
+setup = ["{python} -m pip install -r requirements-dev.txt", "{python} manage.py migrate"]
+run = "{python} manage.py runserver 127.0.0.1:{port}"
+# also = { worker = "{python} -m celery -A kaya worker -B -l INFO" }
+
+[apps.backend.env]
+CORS_ALLOWED_ORIGINS = "{frontends.origins}"
+
+[apps.website]
+kind = "nextjs"
+path = "website"
+port = 3000
+needs = ["backend"]
+run = "npm run dev -- --port {port}"
+repo = "git@github.com:you/website.git"   # `ntc setup` clones it when the folder is missing
+
+[apps.website.env]
+NEXT_PUBLIC_API_BASE_URL = "{backend.url}/api/v1"
+```
+
+Placeholders: `{port}`, `{url}`, `{python}` (this app's), `{<app>.port}`, `{<app>.url}`,
+`{frontends.origins}`. Commands are one program with its arguments (no `&&`), so they run the
+same on Windows and Unix.
 
 ### Technology Options
 

{ntc_dev_kit-1.2.0 → ntc_dev_kit-1.3.0}/README.md

@@ -81,7 +81,85 @@ ntc init -t nextjs --name site --install --yes
 | `--with-auth` / `--no-auth` | Django: include the sign-in app (custom User model, JWT, migration included) |
 | `--env` | Django: `venv`, `conda`, `existing` (the active virtualenv) or `skip` |
 | `--install` / `--no-install` | Others: run `npm install` / `flutter pub get` |
-| `--yes`, `-y` | Ask nothing; needs `--name` and `--technology` |
+| `--apps` | A workspace instead of one app: `backend,website,dashboard,admin,mobile` (any of them) |
+| `--git` | Workspace: `per-app` (default), `single` or `none` |
+| `--yes`, `-y` | Ask nothing; needs `--name` and `--technology` (or `--apps`) |
+
+### Workspaces: several apps at once
+
+Tick more than one app at **What are you building?** (Space ticks) - say a backend, a website and
+an admin dashboard - and they're created side by side in one folder, already connected:
+
+- each app gets its own port, the frontends point at the backend's API, and the backend allows
+  the frontends' origins (CORS);
+- dependencies install for all apps at once, one line each;
+- git: a repository per app (plus a small one at the root for `ntc.toml`), one for everything,
+  or none;
+- `ntc.toml` at the root says how each app is set up and run.
+
+```
+kaya/
+├── ntc.toml        # the apps, their ports, setup and run commands, env
+├── README.md
+├── backend/        # Django REST API   http://127.0.0.1:8000
+├── website/        # Next.js           http://127.0.0.1:3000
+└── admin/          # React admin       http://127.0.0.1:5173
+```
+
+Then, from anywhere inside the workspace:
+
+```bash
+ntc start                  # every app in this terminal: a tab each plus "All"
+ntc start backend admin    # just these (and what they need)
+ntc start --plain          # interleaved output instead (CI, logs)
+ntc setup                  # environments, .env files, dependencies - after a clone or a deep clean
+ntc clean                  # build output and caches; shows the space freed
+ntc clean --deep           # also node_modules and Python environments
+ntc add                    # another app, wired in like the rest
+```
+
+In `ntc start`: **1-9** (or the tabs) switch app, **0** shows all, **r** restarts, **s** stops or
+starts, **o** opens it in the browser, **i** types into it (Flutter's `r` hot reload), **q** quits
+and stops everything. Apps wait for the ones they `need` (the backend) before starting, and a port
+that's already taken is reported instead of crashing.
+
+`ntc clean` only removes what the tools rebuild (`.next`, `dist`, `__pycache__`, caches; with
+`--deep` also `node_modules` and `env`), never anything git tracks, and skips apps that are running.
+`--dry-run` shows what would go.
+
+`ntc.toml` is plain TOML and meant to be edited and committed (no secrets in it - those stay in
+each app's `.env`):
+
+```toml
+name = "kaya"
+
+[apps.backend]
+kind = "django"
+path = "backend"
+port = 8000
+python = "env"
+setup = ["{python} -m pip install -r requirements-dev.txt", "{python} manage.py migrate"]
+run = "{python} manage.py runserver 127.0.0.1:{port}"
+# also = { worker = "{python} -m celery -A kaya worker -B -l INFO" }
+
+[apps.backend.env]
+CORS_ALLOWED_ORIGINS = "{frontends.origins}"
+
+[apps.website]
+kind = "nextjs"
+path = "website"
+port = 3000
+needs = ["backend"]
+run = "npm run dev -- --port {port}"
+repo = "git@github.com:you/website.git"   # `ntc setup` clones it when the folder is missing
+
+[apps.website.env]
+NEXT_PUBLIC_API_BASE_URL = "{backend.url}/api/v1"
+```
+
+Placeholders: `{port}`, `{url}`, `{python}` (this app's), `{<app>.port}`, `{<app>.url}`,
+`{frontends.origins}`. Commands are one program with its arguments (no `&&`), so they run the
+same on Windows and Unix.
 
 ### Technology Options
 

{ntc_dev_kit-1.2.0 → ntc_dev_kit-1.3.0}/ntc/__init__.py

@@ -1,5 +1,5 @@
 """NTC - Nexent Toolkit Console."""
 
-__version__ = "1.2.0"
+__version__ = "1.3.0"
 __author__ = "Nexent"
 __license__ = "MIT"

{ntc_dev_kit-1.2.0 → ntc_dev_kit-1.3.0}/ntc/cli_enhanced.py

@@ -284,8 +284,10 @@ Examples:
   ntc init -t django --name shop-api --with-auth --env venv --yes
                                 # No questions at all (scripts, CI, AI agents)
   ntc init -t nextjs --name site --install --yes
-  ntc compose myproject         # Compose full-stack project with multiple components
-  ntc start                     # Start all services from ntc.yml configuration
+  ntc init --name shop --apps backend,website,admin --yes
+                                # A workspace: several apps wired together, plus ntc.toml
+  ntc start                     # Run the workspace's apps in this terminal
+  ntc setup / ntc clean / ntc add
   ntc create app myapp          # Create new Django app
   ntc drf init path name        # Legacy Django REST Framework initialization
         """
@@ -321,7 +323,11 @@ Examples:
                                help="Next.js/React/Flutter: don't install dependencies")
     init_parser.add_argument("--yes", "-y", action="store_true",
                              help="Don't ask: use the options given and defaults for the rest "
-                                  "(requires --name and --technology)")
+                                  "(requires --name and --technology or --apps)")
+    init_parser.add_argument("--apps", help="A workspace of several apps, comma-separated: "
+                                            "backend, website, dashboard, admin, mobile")
+    init_parser.add_argument("--git", choices=["per-app", "single", "none"],
+                             help="Workspace: a repository per app (default), one for everything, or none")
     
     # Create command for apps
     create_parser = subparsers.add_parser("create", help="Create new components")
@@ -345,13 +351,32 @@ Examples:
     drf_init_parser.add_argument("name", help="Project name")
     
     # Composer command for full-stack project composition
-    composer_parser = subparsers.add_parser("compose", help="Compose a full-stack project with multiple components")
-    composer_parser.add_argument("project_name", help="Name of the project")
-    composer_parser.add_argument("--path", help="Base path to create the project (default: current directory)")
+    subparsers.add_parser("compose", help="Replaced by `ntc init` (pick several apps)")
+    add_parser = subparsers.add_parser("add", help="Add apps to the workspace")
+    add_parser.add_argument("apps", nargs="*", help="backend, website, dashboard, admin, mobile")
+    add_parser.add_argument("--name", help="Folder name (when adding one app)")
+    add_parser.add_argument("--env", choices=["venv", "conda", "existing", "skip"], help="Backend: Python environment")
+    add_auth = add_parser.add_mutually_exclusive_group()
+    add_auth.add_argument("--with-auth", dest="with_auth", action="store_true", default=None)
+    add_auth.add_argument("--no-auth", dest="with_auth", action="store_false")
+    add_install = add_parser.add_mutually_exclusive_group()
+    add_install.add_argument("--install", dest="install", action="store_true", default=None)
+    add_install.add_argument("--no-install", dest="install", action="store_false")
+    add_parser.add_argument("--yes", "-y", action="store_true", help="Don't ask")
+    setup_parser = subparsers.add_parser("setup", help="Install the workspace's apps (after a clone or a deep clean)")
+    setup_parser.add_argument("apps", nargs="*", help="Only these apps")
+    clean_parser = subparsers.add_parser("clean", help="Delete build output and caches; say how much space it freed")
+    clean_parser.add_argument("apps", nargs="*", help="Only these apps")
+    clean_parser.add_argument("--deep", action="store_true",
+                              help="Also dependencies: node_modules, Python environments (`ntc setup` reinstalls)")
+    clean_parser.add_argument("--dry-run", action="store_true", help="Show what would go, delete nothing")
+    clean_parser.add_argument("--yes", "-y", action="store_true", help="Don't ask before deleting")
     
     # Start services command
-    start_parser = subparsers.add_parser("start", help="Start all services defined in ntc.yml")
-    start_parser.add_argument("--path", help="Path to project root directory (default: current directory)")
+    start_parser = subparsers.add_parser("start", help="Run the workspace's apps together in this terminal")
+    start_parser.add_argument("apps", nargs="*", help="Only these apps (and the ones they need)")
+    start_parser.add_argument("--plain", action="store_true",
+                              help="Interleaved output instead of the full-screen view (CI, logs)")
 
     # Doctor command for setup diagnostics
     doctor_parser = subparsers.add_parser("doctor", help="Check setup and fix common issues")
@@ -364,12 +389,20 @@ Examples:
     if args.command == "init":
         technology = args.technology or args.frontend or args.backend
         technology = {"drf": "django", "laravel": "django"}.get(technology, technology)
-        if args.yes and not (args.name and technology):
-            print_error("--yes needs --name and --technology, so there is nothing left to ask.")
+        apps = [a.strip() for a in args.apps.split(",") if a.strip()] if args.apps else None
+        if apps and technology:
+            print_error("Give either --technology (one app) or --apps (a workspace), not both.")
             sys.exit(2)
+        if args.yes and not (args.name and (technology or apps)):
+            print_error("--yes needs --name and --technology (or --apps), so there is nothing left to ask.")
+            sys.exit(2)
+        if apps and len(apps) == 1:
+            from ntc.workspace.config import ROLE_KINDS
+            technology, apps = ROLE_KINDS.get(apps[0], apps[0]), None
         from ntc.wizard import run as run_wizard
         created = run_wizard(technology=technology, name=args.name, path=args.path, with_auth=args.with_auth,
-                             env_choice=args.env, install=args.install, assume_yes=args.yes)
+                             env_choice=args.env, install=args.install, assume_yes=args.yes,
+                             apps=apps, git=args.git)
         sys.exit(0 if created else 1)
     elif args.command == "create" and args.create_type == "app":
         if not is_valid_project_name(args.app_name):
@@ -385,22 +418,23 @@ Examples:
         from ntc.templates.drf_structure.main import init_drf_project
         init_drf_project(args.path, args.name)
     elif args.command == "compose":
-        # Composer for full-stack project composition
-        if not is_valid_project_name(args.project_name):
-            print_error("Project name may only contain letters, numbers, underscores, and hyphens!")
-            sys.exit(1)
-        from ntc.composer.main import compose_project
-        if args.path:
-            compose_project(args.project_name, args.path)
-        else:
-            compose_project(args.project_name)
+        print_info("`ntc compose` is now part of `ntc init`: pick several apps (Space ticks them) and they're "
+                   "created together as a workspace, with an ntc.toml for `ntc start`.")
+        sys.exit(2)
     elif args.command == "start":
-        # Start services from ntc.yml configuration
-        from ntc.composer.main import start_services
-        if args.path:
-            start_services(args.path)
-        else:
-            start_services()
+        from ntc.workspace.start import run as run_start
+        sys.exit(0 if run_start(args.apps, plain=args.plain) else 1)
+    elif args.command == "setup":
+        from ntc.workspace.setup import run as run_setup
+        sys.exit(0 if run_setup(args.apps) else 1)
+    elif args.command == "clean":
+        from ntc.workspace.clean import run as run_clean
+        sys.exit(0 if run_clean(args.apps, deep=args.deep, assume_yes=args.yes, dry_run=args.dry_run) else 1)
+    elif args.command == "add":
+        from ntc.workspace.create import run_add
+        env_choice = {"existing": "active"}.get(args.env, args.env)
+        sys.exit(0 if run_add(args.apps, name=args.name, with_auth=args.with_auth, env_choice=env_choice,
+                              install=args.install, assume_yes=args.yes) else 1)
     elif args.command == "doctor":
         run_doctor()
     elif args.command == "tui":
@@ -412,6 +446,7 @@ Examples:
         print(f"\n  {Fore.LIGHTBLACK_EX}Quick Start:{Style.RESET_ALL}")
         print(f"  {Fore.WHITE}ntc tui{Style.RESET_ALL}               {Fore.LIGHTBLACK_EX}interactive terminal UI{Style.RESET_ALL}")
         print(f"  {Fore.WHITE}ntc init{Style.RESET_ALL}              {Fore.LIGHTBLACK_EX}interactive setup{Style.RESET_ALL}")
+        print(f"  {Fore.WHITE}ntc start{Style.RESET_ALL}             {Fore.LIGHTBLACK_EX}run a workspace's apps{Style.RESET_ALL}")
         print(f"  {Fore.WHITE}ntc init -t django{Style.RESET_ALL}    {Fore.LIGHTBLACK_EX}Django project{Style.RESET_ALL}")
         print(f"  {Fore.WHITE}ntc doctor{Style.RESET_ALL}            {Fore.LIGHTBLACK_EX}check setup{Style.RESET_ALL}")
         print()

{ntc_dev_kit-1.2.0 → ntc_dev_kit-1.3.0}/ntc/templates/auth_app/migrations/0001_initial.py

@@ -1,7 +1,8 @@
-# Generated by Django 5.2.7 on 2026-10-20 14:53
+# Generated by Django 5.2.7 on 2026-10-20 16:26
 
-import django.contrib.auth.models
+import apps.authentication.models
 import django.contrib.auth.validators
+import django.db.models.functions.text
 import django.utils.timezone
 from django.db import migrations, models
 
@@ -23,12 +24,12 @@ class Migration(migrations.Migration):
                 ('last_login', models.DateTimeField(blank=True, null=True, verbose_name='last login')),
                 ('is_superuser', models.BooleanField(default=False, help_text='Designates that this user has all permissions without explicitly assigning them.', verbose_name='superuser status')),
                 ('username', models.CharField(error_messages={'unique': 'A user with that username already exists.'}, help_text='Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.', max_length=150, unique=True, validators=[django.contrib.auth.validators.UnicodeUsernameValidator()], verbose_name='username')),
+                ('first_name', models.CharField(blank=True, max_length=150, verbose_name='first name')),
+                ('last_name', models.CharField(blank=True, max_length=150, verbose_name='last name')),
                 ('is_staff', models.BooleanField(default=False, help_text='Designates whether the user can log into this admin site.', verbose_name='staff status')),
                 ('is_active', models.BooleanField(default=True, help_text='Designates whether this user should be treated as active. Unselect this instead of deleting accounts.', verbose_name='active')),
                 ('date_joined', models.DateTimeField(default=django.utils.timezone.now, verbose_name='date joined')),
                 ('email', models.EmailField(max_length=254, unique=True)),
-                ('first_name', models.CharField(blank=True, max_length=30)),
-                ('last_name', models.CharField(blank=True, max_length=30)),
                 ('phone_number', models.CharField(blank=True, max_length=15)),
                 ('date_of_birth', models.DateField(blank=True, null=True)),
                 ('profile_picture', models.ImageField(blank=True, null=True, upload_to='profile_pics/')),
@@ -41,10 +42,10 @@ class Migration(migrations.Migration):
             options={
                 'verbose_name': 'User',
                 'verbose_name_plural': 'Users',
-                'db_table': 'auth_user',
+                'constraints': [models.UniqueConstraint(django.db.models.functions.text.Lower('email'), name='authentication_user_email_ci_unique')],
             },
             managers=[
-                ('objects', django.contrib.auth.models.UserManager()),
+                ('objects', apps.authentication.models.UserManager()),
             ],
         ),
     ]

ntc_dev_kit-1.3.0/ntc/templates/auth_app/models.py

@@ -0,0 +1,54 @@
+from django.contrib.auth.models import AbstractUser, UserManager as DjangoUserManager
+from django.db import models
+from django.db.models.functions import Lower
+
+
+def normalize_email(email):
+    """Emails are stored lowercase: A@x.com and a@x.com are the same person, and sign-in and
+    password resets look them up exactly."""
+    return (email or '').strip().lower()
+
+
+class UserManager(DjangoUserManager):
+    def _create_user(self, username, email, password, **extra_fields):
+        return super()._create_user(username, normalize_email(email), password, **extra_fields)
+
+    def get_by_natural_key(self, username):
+        # USERNAME_FIELD is the email: sign-in matches it whatever the case typed.
+        return self.get(email=normalize_email(username))
+
+
+class User(AbstractUser):
+    """Custom User model extending AbstractUser. first_name/last_name keep AbstractUser's 150 characters."""
+    email = models.EmailField(unique=True)
+    phone_number = models.CharField(max_length=15, blank=True)
+    date_of_birth = models.DateField(null=True, blank=True)
+    # Stored in R2 when it's configured (STORAGES in settings), on disk in development.
+    profile_picture = models.ImageField(upload_to='profile_pics/', null=True, blank=True)
+    is_verified = models.BooleanField(default=False)
+    created_at = models.DateTimeField(auto_now_add=True)
+    updated_at = models.DateTimeField(auto_now=True)
+
+    objects = UserManager()
+
+    USERNAME_FIELD = 'email'
+    REQUIRED_FIELDS = ['username']
+
+    class Meta:
+        verbose_name = 'User'
+        verbose_name_plural = 'Users'
+        constraints = [
+            # Belt and braces with the lowercase normalization: no two accounts differ only by case.
+            models.UniqueConstraint(Lower('email'), name='authentication_user_email_ci_unique'),
+        ]
+
+    def save(self, *args, **kwargs):
+        self.email = normalize_email(self.email)
+        super().save(*args, **kwargs)
+
+    def __str__(self):
+        return self.email
+
+    @property
+    def full_name(self) -> str:
+        return f"{self.first_name} {self.last_name}".strip()

{ntc_dev_kit-1.2.0 → ntc_dev_kit-1.3.0}/ntc/templates/auth_app/serializers.py

@@ -1,7 +1,7 @@
 from rest_framework import serializers
 from django.contrib.auth import authenticate
 from django.contrib.auth.password_validation import validate_password
-from .models import User
+from .models import User, normalize_email
 
 
 class UserRegistrationSerializer(serializers.ModelSerializer):
@@ -13,6 +13,13 @@ class UserRegistrationSerializer(serializers.ModelSerializer):
         model = User
         fields = ('email', 'username', 'password', 'password_confirm', 'first_name', 'last_name')
 
+    def validate_email(self, value):
+        # Case-insensitive, like the database constraint: A@x.com is already taken by a@x.com.
+        value = normalize_email(value)
+        if User.objects.filter(email=value).exists():
+            raise serializers.ValidationError('An account with this email already exists.')
+        return value
+
     def validate(self, attrs):
         if attrs['password'] != attrs['password_confirm']:
             raise serializers.ValidationError({'password_confirm': "Passwords don't match."})

ntc_dev_kit-1.3.0/ntc/templates/auth_app/tasks.py

@@ -0,0 +1,28 @@
+import logging
+
+from celery import shared_task
+
+from core.services.azure.email.notifier import send_template_email
+from .models import User
+
+logger = logging.getLogger(__name__)
+
+
+@shared_task(bind=True, max_retries=3, default_retry_delay=60)
+def send_password_reset_email(self, user_id, reset_url):
+    """The password-reset email, sent by a worker so the request never waits on the mail server.
+    Retried a few times if sending fails (the link stays valid for PASSWORD_RESET_TIMEOUT)."""
+    user = User.objects.filter(pk=user_id, is_active=True).first()
+    if user is None:
+        return
+    try:
+        send_template_email(
+            subject='Reset your password',
+            to=user.email,
+            template='authentication/password_reset',
+            context={'user': user, 'reset_url': reset_url},
+            sender='no_reply',
+        )
+    except Exception as exc:  # noqa: BLE001 - any mail failure: try again later
+        logger.warning('Password reset email to user %s failed: %s', user_id, exc)
+        raise self.retry(exc=exc)

ntc_dev_kit-1.3.0/ntc/templates/auth_app/templates/authentication/password_reset.html

@@ -0,0 +1,5 @@
+<p>Hi {{ user.first_name|default:user.email }},</p>
+<p>Someone asked to reset the password for your account. If it was you, choose a new password here:</p>
+<p><a href="{{ reset_url }}">Choose a new password</a></p>
+<p>The link works once and expires in a few days. If you didn't ask for this, ignore this email - your
+password stays as it is.</p>

ntc_dev_kit-1.3.0/ntc/templates/auth_app/templates/authentication/password_reset.txt

@@ -0,0 +1,9 @@
+{% autoescape off %}{# plain text: no HTML escaping, or the link shows & #}Hi {{ user.first_name|default:user.email }},
+
+Someone asked to reset the password for your account. If it was you, choose a new password here:
+
+{{ reset_url }}
+
+The link works once and expires in a few days. If you didn't ask for this, ignore this email - your
+password stays as it is.
+{% endautoescape %}

{ntc_dev_kit-1.2.0 → ntc_dev_kit-1.3.0}/ntc/templates/auth_app/tests.py

@@ -104,3 +104,54 @@ def test_sign_in_is_rate_limited_with_a_readable_429(client, user, monkeypatch):
     assert response.status_code == 429
     assert response.data['code'] == 'throttled'
     assert 'Retry-After' in response
+
+
+def test_the_client_gets_the_session_inside_the_envelope(client, user):
+    body = login(client).json()
+    assert body['status'] == 'success'
+    assert body['data']['access']
+    assert body['data']['user']['email'] == 'ada@example.com'
+
+
+def test_email_is_case_insensitive(client, user):
+    response = client.post('/api/v1/auth/register/', {
+        'email': ' ADA@Example.com', 'username': 'ada2', 'password': PASSWORD, 'password_confirm': PASSWORD,
+    }, format='json')
+    assert response.status_code == 400
+    assert 'email' in response.json()['errors']
+    signed_in = client.post('/api/v1/auth/login/', {'email': 'Ada@EXAMPLE.com', 'password': PASSWORD}, format='json')
+    assert signed_in.status_code == 200
+
+
+def test_registration_stores_the_email_lowercase(client, db):
+    client.post('/api/v1/auth/register/', {
+        'email': 'Grace@Example.com', 'username': 'grace', 'password': PASSWORD, 'password_confirm': PASSWORD,
+    }, format='json')
+    assert User.objects.filter(email='grace@example.com').exists()
+
+
+def test_changing_the_password_signs_out_other_sessions_but_not_this_one(client, user):
+    other_device = login(APIClient()).cookies[settings.AUTH_REFRESH_COOKIE].value
+    access = login(client).data['access']
+    client.credentials(HTTP_AUTHORIZATION=f'Bearer {access}')
+    new_password = PASSWORD + '-new'
+    response = client.post('/api/v1/auth/change-password/', {
+        'old_password': PASSWORD, 'new_password': new_password, 'new_password_confirm': new_password,
+    }, format='json')
+    assert response.status_code == 200
+    assert response.data['access']  # this device stays signed in, with a fresh session
+    client.credentials()
+    assert client.post('/api/v1/auth/refresh/').status_code == 200
+    stolen = APIClient().post('/api/v1/auth/refresh/', {'refresh': other_device}, format='json')
+    assert stolen.status_code == 401
+
+
+def test_resetting_the_password_signs_out_every_session(client, user):
+    old_session = login(APIClient()).cookies[settings.AUTH_REFRESH_COOKIE].value
+    client.post('/api/v1/auth/reset-password/', {'email': 'ada@example.com'}, format='json')
+    uid, token = re.search(r'uid=([^&\s]+)&token=([^\s]+)', mail.outbox[0].body).groups()
+    new_password = PASSWORD + '-new'
+    client.post('/api/v1/auth/reset-password-confirm/', {
+        'uid': uid, 'token': token, 'new_password': new_password, 'new_password_confirm': new_password,
+    }, format='json')
+    assert client.post('/api/v1/auth/refresh/', {'refresh': old_session}, format='json').status_code == 401

{ntc_dev_kit-1.2.0 → ntc_dev_kit-1.3.0}/ntc/templates/auth_app/views.py

@@ -1,7 +1,8 @@
+import logging
+
 from django.conf import settings
 from django.contrib.auth.models import update_last_login
 from django.contrib.auth.tokens import default_token_generator
-from django.core.mail import send_mail
 from django.utils.encoding import force_bytes, force_str
 from django.utils.http import urlsafe_base64_decode, urlsafe_base64_encode
 from drf_spectacular.utils import extend_schema, inline_serializer
@@ -16,11 +17,14 @@ from rest_framework_simplejwt.tokens import RefreshToken
 
 from core.response_wrapper import error_response
 from .models import User
+from .tasks import send_password_reset_email
 from .serializers import (
     ChangePasswordSerializer, ResetPasswordConfirmSerializer, ResetPasswordSerializer,
     UpdateProfileSerializer, UserLoginSerializer, UserProfileSerializer, UserRegistrationSerializer,
 )
 
+logger = logging.getLogger(__name__)
+
 
 class AuthRateThrottle(AnonRateThrottle):
     """Anonymous sign-in, registration and reset attempts per IP (THROTTLE_AUTH): against password guessing."""
@@ -162,16 +166,26 @@ def update_profile(request):
     }, status=status.HTTP_200_OK)
 
 
-@extend_schema(request=ChangePasswordSerializer, responses=MessageSerializer)
+def revoke_all_sessions(user):
+    """Blacklist every refresh token the user has, so each session ends at its next refresh. Called
+    when the password changes: a stolen refresh token must not outlive the password it came with."""
+    from rest_framework_simplejwt.token_blacklist.models import BlacklistedToken, OutstandingToken
+    tokens = OutstandingToken.objects.filter(user=user).exclude(blacklistedtoken__isnull=False)
+    BlacklistedToken.objects.bulk_create([BlacklistedToken(token=t) for t in tokens], ignore_conflicts=True)
+
+
+@extend_schema(request=ChangePasswordSerializer, responses=SessionSerializer)
 @api_view(['POST'])
 @permission_classes([IsAuthenticated])
 def change_password(request):
-    """Change the password, given the current one."""
+    """Change the password, given the current one. Every other session is signed out; this one gets
+    a fresh session so the user stays signed in here."""
     serializer = ChangePasswordSerializer(data=request.data, context={'request': request})
     serializer.is_valid(raise_exception=True)
     request.user.set_password(serializer.validated_data['new_password'])
     request.user.save(update_fields=['password'])
-    return Response({'message': 'Password changed successfully'}, status=status.HTTP_200_OK)
+    revoke_all_sessions(request.user)
+    return _session(request.user, 'Password changed successfully')
 
 
 @extend_schema(request=ResetPasswordSerializer, responses=MessageSerializer)
@@ -188,13 +202,12 @@ def reset_password(request):
         uid = urlsafe_base64_encode(force_bytes(user.pk))
         token = default_token_generator.make_token(user)
         reset_url = f"{settings.FRONTEND_URL}/reset-password-confirm?uid={uid}&token={token}"
-        send_mail(
-            'Password Reset Request',
-            f'Click the link to reset your password: {reset_url}',
-            settings.DEFAULT_FROM_EMAIL,
-            [user.email],
-            fail_silently=False,
-        )
+        # Sent by a worker (tasks.py): the request doesn't wait on the mail server, and neither a
+        # mail outage nor an unreachable queue turns this into a 500 - the answer is the same either way.
+        try:
+            send_password_reset_email.delay(user.pk, reset_url)
+        except Exception:  # noqa: BLE001
+            logger.exception('Could not queue the password reset email for user %s', user.pk)
     return Response({'message': 'If that email has an account, a reset link is on its way.'},
                     status=status.HTTP_200_OK)
 
@@ -215,4 +228,5 @@ def reset_password_confirm(request):
         return error_response('This link is invalid or has expired. Please request a new one.', 400)
     user.set_password(serializer.validated_data['new_password'])
     user.save(update_fields=['password'])
+    revoke_all_sessions(user)  # whoever had the old password is signed out everywhere
     return Response({'message': 'Password reset successful'}, status=status.HTTP_200_OK)