Using djmongoauth
What is it?
djmongoauth provides out-of-the-box support for basic user management and additional operations including user registration, login, logout, email verification, password recovery for backends built with the Django web framework and MongoDB.
djmongoauth is based on djongo, a MongoDB ORM for Django.
Installation
Install djmongoauth through pip:
[email protected]:~$ sudo pip3 install djmongoauth
PyPI package can be found at https://pypi.org/project/djmongoauth/0.0.1/
Use cases
User object
User object is the core of the djmongoauth. It represents a authenticable entity. The primary attributes of a default user instance are:
usernameemailpasswordemail_verifiedemail_verified_at
Register a new user
def register(request):
req_body = json.loads(request.body.decode("UTF-8"))
user = User()
user.username = req_body["username"]
user.email = req_body["email"]
user.password = req_body["password"]
try:
user.register()
except Exception as e:
return JsonResponse({"error": str(e)}, status=400)
return HttpResponse(status=201)
request.methodmust bePOST- Body of
requestmust have these attributes and they must be well-formed:username,email,password. Password can be cleartext (djmongoauthtakes care of hashing / decryption)
Log in
def login(request):
try:
req_body = json.loads(request.body.decode("UTF-8"))
x_auth_token = User.login(req_body["username"], req_body["password"])
except Exception as e:
return JsonResponse({"error": str(e)}, status=400)
return JsonResponse({"token": x_auth_token})
request.methodmust bePOST- Body of
requestmust have these attributes:usernameandpassword login()call returns ax_auth_token. This token should be returned to your site's frontend and serve as a basic auth token in theHTTP_AUTHORIZATIONheader for all subsequent requests till the token expires
Log out
def logout(request):
try:
User.logout(request)
except Exception as e:
return JsonResponse({"error": str(e)}, status=400)
return HttpResponse(status=204)
requestmust have itsHTTP_AUTHORIATIONheader set to thex_auth_tokenreturned fromlogincall
Email verification
# handler for verifying email address
def verify_email(request):
if request.method == "POST":
return _send_verify_email(request)
elif request.method == "PUT":
return _handle_email_verification(request)
else:
return HttpResponse(status=405)
def _send_verify_email(request):
try:
User.send_email(request, type=EmailTypes.VERIFY)
return HttpResponse(status=201)
except Exception as e:
return JsonResponse({"error": str(e)}, status=400)
def _handle_email_verification(request):
try:
User.handle_email_request(request, EmailTypes.VERIFY)
return HttpResponse(status=200)
except Exception as e:
return JsonResponse({"error": str(e)}, status=400)
A verification email will be sent to the user's registered email address. Following is a sample verification email:
Hello test_user:
Please use the following link to verify your email address on test.com
https://test.com/verify?a=wMw_qmXu8fZOlcHP1Xpku4e8nuo8rCQim0AHzp5Taqtk0CWq2sThbEMu5kVCcy5leVYDpHKfY6-fMc_4HZBbQg
This link will expire on 2021-09-12 02:04:21 UTC
Thank you for using test.com!
requestmust have itsHTTP_AUTHORIATIONheader set to thex_auth_tokenreturned fromlogincall- To send a verification email,
POSTthis endpoint; to handle a email verification request,PUTthis endpoint with parameteraset. Example:PUT https://api.test.com/verify?a=wMw_qmXu8fZOlcHP1Xpku4e8nuo8rCQim0AHzp5Taqtk0CWq2sThbEMu5kVCcy5leVYDpHKfY6-fMc_4HZBbQg - If using a hosted email domain service (example: GSuite), please ensure that options such as less secure apps are enabled (Gmail)
Password reset
def reset_password(request):
if request.method == "POST":
return _send_recovery_email(request)
elif request.method == "PUT":
return _handle_password_recovery(request)
else:
return HttpResponse(status=405)
def _send_recovery_email(request):
try:
User.send_email(request, type=EmailTypes.RESET)
return HttpResponse(status=200)
except Exception as e:
return JsonResponse({"error": str(e)}, status=400)
def _handle_password_recovery(request):
try:
User.handle_email_request(request, EmailTypes.RESET)
return HttpResponse(status=200)
except Exception as e:
return JsonResponse({"error": str(e)}, status=400)
A password reset email will be sent to the user's registered email address. Following is a sample password reset email:
Hello test_user,
A request has been received to change the password for your account on test.com
Please follow this link to reset your password: https://test.com/reset?a=XfNKZT-OXXvvto3fDAyo5l46Ssmx1wQkXzlYGxQKyhFq3FTNve4vrvNYu8b8ha2erghRWtWfwFT5TT7O9xgM6Q
This link will expire on 2021-09-12 02:34:45 UTC
If you did not initiate this request, please ignore this email.
- To send a password reset email,
POSTthis endpoint; to handle a password reset request,PUTthis endpoint with parameter a set. Example:PUT https://api.test.com/reset?a=wMw_qmXu8fZOlcHP1Xpku4e8nuo8rCQim0AHzp5Taqtk0CWq2sThbEMu5kVCcy5leVYDpHKfY6-fMc_4HZBbQg - When
PUTting this endpoint, body ofrequestmust have these attributes:new_password.new_passwordcan be cleartext (djmongoauthtakes care of hashing / decryption)
Decorator
@authenticated
Use this decorator on request handlers, etc. to ensure a user is already logged in
from djmongoauth.decorators.authenticated import authenticated
@authenticated
def my_other_view_handler(request):
pass
If a user is not properly authenticated (e.g. not logged in / login session has expired), a DjMongoAuthError will be raised
91 Nov 24, 2022
210 Dec 24, 2022
3 Jan 08, 2022
321 Dec 18, 2022
8 May 31, 2022
49 Dec 23, 2022
23 Aug 01, 2022
315 Dec 25, 2022
468 Jan 01, 2023
2.8k Dec 24, 2022
1 Jan 02, 2022
1.6k Dec 19, 2022
181 Jan 01, 2023
1 Feb 01, 2022
15 Dec 11, 2022
35 Dec 20, 2022
7.7k Jan 03, 2023
787 Dec 13, 2022
417 Jan 07, 2023