ソースを参照

fix(api): removes routing to Djoser's multi-token-incompatible views

We imported the following URL configuration from Djoser
(djoser/urls/authtoken.py):

	urlpatterns = [
	    url(
		r'^token/create/?$',
		views.TokenCreateView.as_view(),
		name='token-create'
	    ),
	    url(
		r'^token/destroy/?$',
		views.TokenDestroyView.as_view(),
		name='token-destroy'
	    ),
	    url(
		r'^token/login/?$',
		views.TokenCreateView.as_view(),
		name='login'
	    ),
	    url(
		r'^token/logout/?$',
		views.TokenDestroyView.as_view(),
		name='logout'
	    ),
	]

Note that the trailing slash is optional in all four routes. While
the api defined four routes overriding the ones defined by Djoser,
they do not cover the case where no trailing slash is given. However,
Djoser's views are not compatible with api's multi-token solution.

This lead to the situation where an attempted login caused a server
error when an user had more than one token and used the Djoser login
view (by not using a trailing slash).

This commit removes Djoser's views from api's routing altogether (it
is not clear why we kept them in the first place). All four views
(names 'token-create', 'token-destroy', 'login', and 'logout') are
covered by api-defined views.

Functionality changes when no trailing slash is given. Previously,
it was mostly working. Now, we always return 301.
Nils Wisiol 6 年 前
コミット
0c09855b36
2 ファイル変更1 行追加14 行削除
  1. 1 13
      api/desecapi/tests/test_authentication.py
  2. 0 1
      api/desecapi/urls/version_1.py

+ 1 - 13
api/desecapi/tests/test_authentication.py

@@ -51,7 +51,7 @@ class SignUpLoginTestCase(DesecTestCase):
     LOGIN_ENDPOINT = None
 
     REGISTRATION_STATUS = status.HTTP_201_CREATED
-    LOGIN_STATUS = status.HTTP_200_OK
+    LOGIN_STATUS = status.HTTP_201_CREATED
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -102,24 +102,12 @@ class URLSignUpLoginTestCase(SignUpLoginTestCase):
     REGISTRATION_ENDPOINT = '/api/v1/auth/users/'
     LOGIN_ENDPOINT = '/api/v1/auth/token/login/'
 
-    LOGIN_STATUS = status.HTTP_201_CREATED
-
 
 class LegacyURLSignUpLoginTestCase(SignUpLoginTestCase):
 
     REGISTRATION_ENDPOINT = '/api/v1/auth/users/create/'
     LOGIN_ENDPOINT = '/api/v1/auth/token/create/'
 
-    LOGIN_STATUS = status.HTTP_201_CREATED
-
-
-class LegacyURLSignUpLoginTestCase2(SignUpLoginTestCase):
-
-    REGISTRATION_ENDPOINT = '/api/v1/auth/users/create/'
-    LOGIN_ENDPOINT = '/api/v1/auth/token/create'
-
-    LOGIN_STATUS = status.HTTP_200_OK
-
 
 class TokenAuthenticationTestCase(DynDomainOwnerTestCase):
 

+ 0 - 1
api/desecapi/urls/version_1.py

@@ -20,7 +20,6 @@ auth_urls = [
     # Token management
     path('token/login/', views.TokenCreateView.as_view(), name='login'),
     path('token/logout/', views.TokenDestroyView.as_view(), name='logout'),
-    path('', include('djoser.urls.authtoken')),  # note: this is partially overwritten by the two lines above
     path('tokens/', include(tokens_router.urls)),
 
     # User home