stash

backend/authentication/api.py

@@ -10,7 +10,8 @@ from rest_framework.authtoken.views import ObtainAuthToken
 from rest_framework.response import Response
 
 from authentication.models import ToolshedUser, AccountPreference
-from authentication.signature_auth import SignatureAuthenticationLocal
+from authentication.signature_auth import SignatureAuthenticationLocal, SignatureAuthentication, \
+    split_userhandle_or_throw
 from files.models import File
 from files.serializers import FileSerializer
 from hostadmin.models import Domain
@@ -101,6 +102,9 @@ class UserViewSet(viewsets.ModelViewSet):
 @permission_classes([IsAuthenticated])
 @authentication_classes([SignatureAuthenticationLocal])
 def getUserInfo(request):
+    """Get or update the authenticated local user's own account info. Only usable by the
+    account owner on their own home server - see getUserProfile for viewing another (friend)
+    user's public profile."""
     user = request.user
     if request.method == 'PATCH':
         old_file = user.profile_picture
@@ -137,6 +141,30 @@ def getUserInfo(request):
     })
 
 
+@api_view(['GET'])
+@permission_classes([IsAuthenticated])
+@authentication_classes([SignatureAuthentication])
+def getUserProfile(request, handle):
+    """Get another local user's public profile by handle (username@domain), e.g. so a friend
+    can look up someone's avatar. The caller must be a friend of that user (or the user
+    itself, signing with their own known identity rather than their local credentials)."""
+    try:
+        username, domain = split_userhandle_or_throw(handle)
+    except ValueError:
+        return Response(status=400)
+    try:
+        target = ToolshedUser.objects.get(username=username, domain=domain)
+    except ToolshedUser.DoesNotExist:
+        return Response(status=404)
+    if target not in request.user.friends_or_self():
+        return Response(status=403)
+    return Response({
+        'username': target.username,
+        'domain': target.domain,
+        'profile_picture': FileSerializer(target.profile_picture).data if target.profile_picture else None,
+    })
+
+
 @api_view(['POST'])
 @permission_classes([])
 @authentication_classes([])
@@ -212,6 +240,7 @@ router.register(r'users', UserViewSet)
 urlpatterns = [
     path('', include(router.urls)),
     path('user/', getUserInfo),
+    path('user/<str:handle>/', getUserProfile),
     path('register/', registerUser),
     path('token/', UserAuthToken.as_view()),
     path('preferences/', preference_definitions),

backend/authentication/signature_auth.py

@@ -106,11 +106,19 @@ def authenticate_request_against_local_users(request, raw_request_body):
 
 class SignatureAuthentication(authentication.BaseAuthentication):
     def authenticate(self, request):
-        return authenticate_request_against_known_identities(
-            request, request.body.decode('utf-8')), None
+        identity = authenticate_request_against_known_identities(request, request.body.decode('utf-8'))
+        # Returning a bare None (rather than a (None, None) tuple) tells DRF this
+        # authenticator doesn't apply, so it moves on to the next authenticator in the
+        # authentication_classes list instead of treating the request as authenticated
+        # with an empty user.
+        if identity is None:
+            return None
+        return identity, None
 
 
 class SignatureAuthenticationLocal(authentication.BaseAuthentication):
     def authenticate(self, request):
-        return authenticate_request_against_local_users(
-            request, request.body.decode('utf-8')), None
+        user = authenticate_request_against_local_users(request, request.body.decode('utf-8'))
+        if user is None:
+            return None
+        return user, None

backend/authentication/tests/test_auth.py

@@ -355,6 +355,52 @@ class UserApiTestCase(UserTestMixin, ToolshedTestCase):
         self.assertEqual(reply.status_code, 403)
 
 
+class UserProfileByHandleApiTestCase(UserTestMixin, ToolshedTestCase):
+    """Tests for GET /auth/user/<handle>/ - viewing another (friend) user's public profile."""
+
+    def setUp(self):
+        super().setUp()
+        self.prepare_users()
+        self.f['local_user1'].friends.add(self.f['ext_user1'].public_identity)
+        self.anonymous_client = Client(SERVER_NAME='testserver')
+        self.client = SignatureAuthClient()
+
+    def test_view_friend_profile(self):
+        target = '/auth/user/' + str(self.f['local_user1']) + '/'
+        reply = self.client.get(target, self.f['ext_user1'])
+        self.assertEqual(reply.status_code, 200)
+        self.assertEqual(reply.json()['username'], 'testuser1')
+        self.assertEqual(reply.json()['domain'], 'example.com')
+        self.assertIsNone(reply.json()['profile_picture'])
+        self.assertNotIn('email', reply.json())
+
+    def test_view_own_profile_via_handle(self):
+        target = '/auth/user/' + str(self.f['local_user1']) + '/'
+        reply = self.client.get(target, self.f['local_user1'])
+        self.assertEqual(reply.status_code, 200)
+        self.assertEqual(reply.json()['username'], 'testuser1')
+
+    def test_view_profile_not_friend(self):
+        target = '/auth/user/' + str(self.f['local_user1']) + '/'
+        reply = self.client.get(target, self.f['ext_user2'])
+        self.assertEqual(reply.status_code, 403)
+
+    def test_view_profile_unknown_user(self):
+        target = '/auth/user/nosuchuser@example.com/'
+        reply = self.client.get(target, self.f['ext_user1'])
+        self.assertEqual(reply.status_code, 404)
+
+    def test_view_profile_bad_handle(self):
+        target = '/auth/user/notahandle/'
+        reply = self.client.get(target, self.f['ext_user1'])
+        self.assertEqual(reply.status_code, 400)
+
+    def test_view_profile_unauthenticated(self):
+        target = '/auth/user/' + str(self.f['local_user1']) + '/'
+        reply = self.anonymous_client.get(target)
+        self.assertEqual(reply.status_code, 403)
+
+
 class FriendApiTestCase(UserTestMixin, ToolshedTestCase):
     def setUp(self):
         super().setUp()