Working .env setup

nonpacks/common/middleware.py

@@ -1,5 +1,18 @@
 import time
 
+from django.conf import settings
+from django.http import HttpResponseRedirect, JsonResponse
+from django.urls import Resolver404, resolve
+
+try:
+    from django.utils.timezone import now
+except Exception:  # pragma: no cover
+    from datetime import datetime
+
+    def now():
+        return datetime.now()
+
+
 class TimingMiddleware:
     def __init__(self, get_response):
         self.get_response = get_response
@@ -7,4 +20,116 @@ class TimingMiddleware:
     def __call__(self, request):
         request._start_time = time.time()
         response = self.get_response(request)
-        return response
+        return response
+
+
+def _is_whitelisted(request):
+    """Check whether the resolved view is marked with @gate_whitelist."""
+    try:
+        resolver_match = resolve(request.path_info)
+    except Resolver404:
+        return False
+    func = resolver_match.func
+    if getattr(func, '__gate_whitelist__', False):
+        return True
+    view_class = getattr(func, 'view_class', None)
+    if view_class and getattr(view_class, '__gate_whitelist__', False):
+        return True
+    return False
+
+
+def _is_token_request(request):
+    """Token is honoured only for non-browser download/API requests."""
+    path = request.path_info
+    if path.startswith('/api/') or path.startswith('/media/'):
+        return True
+    accept = request.META.get('HTTP_ACCEPT', '')
+    if 'application/json' in accept:
+        return True
+    if request.headers.get('X-Requested-With') == 'XMLHttpRequest':
+        return True
+    return False
+
+
+def _is_api_request(request):
+    """Requests that must 401 (never redirect to an HTML page)."""
+    path = request.path_info
+    if path.startswith('/api/') or path.startswith('/media/'):
+        return True
+    accept = request.META.get('HTTP_ACCEPT', '')
+    if 'application/json' in accept:
+        return True
+    if request.headers.get('X-Requested-With') == 'XMLHttpRequest':
+        return True
+    return False
+
+
+def _get_bearer_token(request):
+    auth = request.headers.get('Authorization', '')
+    if auth.lower().startswith('bearer '):
+        return auth.split(' ', 1)[1].strip()
+    explicit = request.headers.get('X-Auth-Token')
+    return explicit or None
+
+
+def _authenticate_token(request, token):
+    import hmac
+
+    from django.utils import timezone
+
+    from profiles.models import ApiToken
+
+    if not token:
+        return False
+    prefix = token[:8]
+    # Matches on the prefix keyed index, then constant-time compares.
+    for candidate in ApiToken.objects.filter(key_prefix=prefix):
+        if hmac.compare_digest(candidate.token or '', token):
+            candidate.last_used = timezone.now()
+            candidate.save(update_fields=['last_used'])
+            setattr(request, 'user', candidate.user)
+            setattr(request, '_cached_user', candidate.user)
+            return True
+    return False
+
+
+def gate_whitelist(view_func):
+    """Mark a view as public (bypasses the gate)."""
+    view_func.__gate_whitelist__ = True
+    return view_func
+
+
+class GateMiddleware:
+    """Gate every request behind the master-password session or an API token.
+
+    Public views must be decorated with @gate_whitelist.
+    """
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        # Public static assets must load on the gate page itself.
+        if request.path_info.startswith(settings.STATIC_URL):
+            return self.get_response(request)
+
+        # @gate_whitelist views (gate page + its POST) pass through.
+        if _is_whitelisted(request):
+            return self.get_response(request)
+
+        # API/media requests are allowed a bearer token to bypass the gate
+        # (non-browser downloaders such as the Fabric mod).
+        if _is_token_request(request):
+            token = _get_bearer_token(request)
+            if _authenticate_token(request, token):
+                return self.get_response(request)
+            # fall through: reject with 401 for API/media.
+
+        # Browser session authorized by the master password.
+        if request.session.get('authorized'):
+            return self.get_response(request)
+
+        # Unauthorized: reject.
+        if _is_api_request(request):
+            return JsonResponse({'detail': 'Unauthorized'}, status=401)
+        return HttpResponseRedirect(settings.GATE_URL)

nonpacks/common/settings.py

@@ -54,6 +54,7 @@ MIDDLEWARE = [
     'django.contrib.messages.middleware.MessageMiddleware',
     'django.middleware.clickjacking.XFrameOptionsMiddleware',
     'common.middleware.TimingMiddleware',
+    'common.middleware.GateMiddleware',
 ]
 
 ROOT_URLCONF = 'common.urls'
@@ -61,7 +62,7 @@ ROOT_URLCONF = 'common.urls'
 TEMPLATES = [
     {
         'BACKEND': 'django.template.backends.django.DjangoTemplates',
-        'DIRS': [],
+        'DIRS': [BASE_DIR / 'templates'],
         'APP_DIRS': True,
         'OPTIONS': {
             'context_processors': [
@@ -130,7 +131,10 @@ SESSION_COOKIE_AGE = 86400
 
 # Production Server BS over here
 CSRF_TRUSTED_ORIGINS = [
-    'https://jakerasp.rainbow-herring.ts.net'
+    'https://jakerasp.rainbow-herring.ts.net',
+    'http://127.0.0.1'
+    'http://jakerasp',
+    'http://localhost'
 ]
 SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
 USE_X_FORWARDED_HOST = True
@@ -147,7 +151,15 @@ STATIC_URL = '/static/'
 STATICFILES_DIRS = [os.path.join(BASE_DIR, 'static')]
 STATIC_ROOT = BASE_DIR / 'staticfiles'
 
+# Media (pack downloads, user assets) — served through Django behind the gate
+MEDIA_URL = '/media/'
+MEDIA_ROOT = BASE_DIR / 'media'
+
 # Login settings
-LOGIN_URL = 'login'
+LOGIN_URL = 'profiles:login'
+LOGIN_REDIRECT_URL = '/'
+
+# Gate settings — URL the GateMiddleware redirects HTML pages to
+GATE_URL = '/'
 
 SESSION_EXPIRE_AT_BROWSER_CLOSE = False

nonpacks/common/urls.py

@@ -1,22 +1,16 @@
 """
 URL configuration for common project.
-
-The `urlpatterns` list routes URLs to views. For more information please see:
-    https://docs.djangoproject.com/en/6.0/topics/http/urls/
-Examples:
-Function views
-    1. Add an import:  from my_app import views
-    2. Add a URL to urlpatterns:  path('', views.home, name='home')
-Class-based views
-    1. Add an import:  from other_app.views import Home
-    2. Add a URL to urlpatterns:  path('', Home.as_view(), name='home')
-Including another URLconf
-    1. Import the include() function: from django.urls import include, path
-    2. Add a URL to urlpatterns:  path('blog/', include('blog.urls'))
 """
+from django.conf import settings
+from django.conf.urls.static import static
 from django.contrib import admin
-from django.urls import path
+from django.urls import include, path
 
 urlpatterns = [
+    path('', include('landing.urls')),
+    path('', include('profiles.urls')),
     path('admin/', admin.site.urls),
 ]
+
+if settings.DEBUG:
+    urlpatterns += static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT)