Snapshot: alpha-2026-9

backend/authentication/api.py

@@ -9,8 +9,11 @@ from rest_framework.authtoken.models import Token
 from rest_framework.authtoken.views import ObtainAuthToken
 from rest_framework.response import Response
 
-from authentication.models import ToolshedUser
-from authentication.signature_auth import SignatureAuthenticationLocal
+from authentication.models import ToolshedUser, AccountPreference
+from authentication.signature_auth import SignatureAuthenticationLocal, SignatureAuthentication, \
+    split_userhandle_or_throw
+from files.models import File
+from files.serializers import FileSerializer
 from hostadmin.models import Domain
 
 router = routers.SimpleRouter()
@@ -53,15 +56,71 @@ class UserViewSet(viewsets.ModelViewSet):
     permission_classes = [IsAuthenticated, IsAdminUser]
 
 
-@api_view(['GET'])
+@api_view(['GET', 'PATCH'])
 @permission_classes([IsAuthenticated])
 @authentication_classes([SignatureAuthenticationLocal])
 def getUserInfo(request):
+    """Get or update the authenticated local user's own account info; only the account owner may
+    call this on their own home server (see getUserProfile for viewing a friend's public profile)."""
     user = request.user
+    if request.method == 'PATCH':
+        old_file = user.profile_picture
+        if 'profile_picture' in request.data:
+            profile_picture = request.data.get('profile_picture')
+            if profile_picture is None:
+                user.profile_picture = None
+            elif type(profile_picture) == dict:
+                serializer = FileSerializer(data=profile_picture)
+                if not serializer.is_valid():
+                    return Response(serializer.errors, status=400)
+                user.profile_picture = serializer.save()
+            else:
+                return Response({'profile_picture': 'Must be null or an object with data and mime_type.'}, status=400)
+        elif 'profile_picture_id' in request.data:
+            profile_picture_id = request.data.get('profile_picture_id')
+            if profile_picture_id is None:
+                user.profile_picture = None
+            else:
+                try:
+                    user.profile_picture = File.objects.get(id=profile_picture_id)
+                except File.DoesNotExist:
+                    return Response({'profile_picture_id': 'File does not exist.'}, status=400)
+        user.save()
+
+        if old_file and old_file != user.profile_picture and old_file.connected_items.count() == 0 \
+                and old_file.profile_picture_users.count() == 0 and old_file.staged_by_workflows.count() == 0:
+            old_file.file.delete(save=False)
+            old_file.delete()
+
     return Response({
         'username': user.username,
         'domain': user.domain,
-        'email': user.email
+        'email': user.email,
+        'profile_picture': FileSerializer(user.profile_picture).data if user.profile_picture else None,
+    })
+
+
+@api_view(['GET'])
+@permission_classes([IsAuthenticated])
+@authentication_classes([SignatureAuthentication])
+def getUserProfile(request, handle):
+    """Get another local user's public profile by handle, e.g. so a friend can look up an avatar;
+    caller must be a friend of that user (or the user itself, signing with their own known
+    identity rather than local credentials)."""
+    try:
+        username, domain = split_userhandle_or_throw(handle)
+    except ValueError:
+        return Response(status=400)
+    try:
+        target = ToolshedUser.objects.get(username=username, domain=domain)
+    except ToolshedUser.DoesNotExist:
+        return Response(status=404)
+    if target not in request.user.friends_or_self():
+        return Response(status=403)
+    return Response({
+        'username': target.username,
+        'domain': target.domain,
+        'profile_picture': FileSerializer(target.profile_picture).data if target.profile_picture else None,
     })
 
 
@@ -99,11 +158,40 @@ def registerUser(request):
         return Response({'errors': {'domain': 'Domain does not exist or is not open for registration'}}, status=400)
 
 
+@api_view(['GET', 'PUT'])
+@permission_classes([IsAuthenticated])
+@authentication_classes([SignatureAuthenticationLocal])
+def account_preferences(request):
+    """Get or bulk-upsert the authenticated user's account-level preferences: GET returns the
+    current preferences as {key: value}; PUT sets/overwrites one or more, leaving unspecified
+    keys untouched."""
+    if request.method == 'PUT':
+        if not isinstance(request.data, dict):
+            return Response({'detail': 'Expected an object of key/value pairs.'}, status=400)
+        for key, value in request.data.items():
+            AccountPreference.objects.update_or_create(user=request.user, key=key, defaults={'value': value})
+
+    preferences = {pref.key: pref.value for pref in request.user.preferences.all()}
+    return Response(preferences)
+
+
+@api_view(['DELETE'])
+@permission_classes([IsAuthenticated])
+@authentication_classes([SignatureAuthenticationLocal])
+def account_preference_detail(request, key):
+    """Reset a single account-level preference back to its default by deleting it."""
+    AccountPreference.objects.filter(user=request.user, key=key).delete()
+    return Response(status=204)
+
+
 router.register(r'users', UserViewSet)
 
 urlpatterns = [
     path('', include(router.urls)),
     path('user/', getUserInfo),
+    path('user/<str:handle>/', getUserProfile),
     path('register/', registerUser),
     path('token/', UserAuthToken.as_view()),
+    path('self/preferences/', account_preferences),
+    path('self/preferences/<str:key>/', account_preference_detail),
 ]