davidcr01
commented
1 year ago Update Report
Mockups
A mockup has been done to represent the idea of the pages. The mockup is done in Figma:
The staff code will be an optional input. If the user fills it, it means that the user wants to be an administrator.
Staff codes
The staff codes will be used only when registering administrators (EM, event managers). These codes will be delivered by the superuser of the platform.
To represent this information, a new model has been created:
class StaffCode(models.Model):
code = models.CharField(max_length=20)
used = models.BooleanField(default=False)
def __str__(self):
return self.codeJust added a field used to control if the code has been used or not. This does not mean that a code can be used more than one time. But is a good idea to deny the use of the same code in a short period of time due to security reasons.
To apply these changes, create the migrations and migrate with:
docker-compose exec dj python manage.py makemigrations djapi
docker-compose exec dj python manage.py migrate djapiTo apply this logic, it is necessary to modify the serializer of the CustomUser, specifically the create method.
The following code:
- Establish the
staff_codefield as write_only (not editable) and not required. - Defines a new method
validate_staff_codethat checks if the code passed in the body exists and it's not used. - If it's valid, create the user as a staff member, and establish the code as used.
class CustomUserSerializer(serializers.ModelSerializer):
password = serializers.CharField(write_only=True)
...
def validate_staff_code(self, value):
if value and not StaffCode.objects.filter(code=value, used=False).exists():
raise serializers.ValidationError('Invalid staff code.')
return value
def create(self, validated_data):
password = validated_data.pop('password')
staff_code = validated_data.pop('staff_code', None)
validated_data['password'] = make_password(password) # Encrypt the password
# These fields are ignored of the body
validated_data.pop('is_staff', None)
validated_data.pop('is_superuser', None)
is_staff = False
if staff_code:
staff_code_obj = StaffCode.objects.get(code=staff_code, used=False)
staff_code_obj.used = True
staff_code_obj.save()
is_staff = True
user = CustomUser.objects.create(is_staff=is_staff, **validated_data)
return userLet's test the behavior of this new logic:
✔️ If the code exists, the user is created:
{
"username": "admin",
"password": "test123test",
"email": "admin@gmail.com",
"staff_code": "819493"
}Result:
{
"id": 29,
"is_superuser": false,
"username": "admin",
....
"is_staff": true,
"groups": [
3
],
}Notice that the group is automatically assigned due to #9
✔️ If we try to create another user with the same code, we got this error
{
"staff_code": [
"Invalid staff code."
]
}✔️ If we try to create another user without a staff code and specify the is_staff field, the user will be created but NOT as a staff member.
{
"username": "admin4",
"password": "test123test",
"email": "admin@gmail.com",
"is_staff": "True"
} "id": 31,
"is_superuser": false,
"username": "admin4",
"is_staff": false,
"groups": [],With this, the staff members are created with a staff code mandatorily.
Description
The register page will display all the necessary fields to create an user. The form should be validate before inserting the user in the backend. To register the administrators (event managers), they will have to insert a staff code given by the superuser. This is a straightforward security method to register authorized staff members. To perform this, is necessary to create a new model that stores some codes.
Tasks
⚠️ The registration of administrators (EM) is done in this issue which is related to Sprint 2, but due to design reasons it has been done in this Sprint (1)
Some of the tasks in the description were done in previous issues: