# 456 Rework API key creation

* removes frontend input field holding generated API key
* replaces with modal form
* reworks tests on API token form

user/forms/modals/api_token.py

@@ -0,0 +1,49 @@
+"""
+Author: Michel Peltriaux
+Created on: 08.01.25
+
+"""
+from django import forms
+from django.utils.translation import gettext_lazy as _
+
+from api.models import APIUserToken
+from konova.forms.modals import BaseModalForm
+from konova.utils.mailer import Mailer
+
+
+class NewAPITokenModalForm(BaseModalForm):
+    confirm = forms.BooleanField(
+        label=_("Confirm"),
+        label_suffix=_(""),
+        widget=forms.CheckboxInput(),
+        required=True,
+    )
+
+    def __init__(self, *args, **kwargs):
+        self.template = "modal/modal_form.html"
+        super().__init__(*args, **kwargs)
+        self.form_title = _("Generate API Token")
+
+        self.form_caption = ""
+        if self.__user_has_api_token():
+            self.form_caption = _("You are about to create a new API token. The existing one will not be usable afterwards.")
+            self.form_caption += "\n"
+        self.form_caption += _("A new token needs to be validated by an administrator!")
+        # Disable automatic w-100 setting for this type of modal form. Looks kinda strange
+        self.fields["confirm"].widget.attrs["class"] = ""
+
+    def __user_has_api_token(self):
+        return self.instance.api_token is not None
+
+    def save(self):
+        user = self.instance
+        if user.api_token is not None:
+            user.api_token.delete()
+        user.api_token = APIUserToken.objects.create()
+        user.save()
+
+        mailer = Mailer()
+        mailer.send_mail_verify_api_token(user)
+
+        return user.api_token
+

user/forms/user.py

@@ -66,48 +66,3 @@ class UserNotificationForm(BaseForm):
             id__in=selected_notification_ids,
         )
         self.user.notifications.set(notifications)
-
-
-class UserAPITokenForm(BaseForm):
-    token = forms.CharField(
-        label=_("Token"),
-        label_suffix="",
-        max_length=255,
-        required=True,
-        help_text=_("Generated automatically - not editable"),
-        widget=GenerateInput(
-            attrs={
-                "class": "form-control",
-                "url": reverse_lazy("api:generate-new-token"),
-            }
-        )
-    )
-
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        self.form_title = _("Create new token")
-        self.form_caption = _("A new token needs to be validated by an administrator!")
-
-        self.action_url = reverse("user:api-token")
-        self.cancel_redirect = reverse("user:index")
-
-        # Make direct token editing by user impossible. Instead set the proper url for generating a new token
-        self.initialize_form_field("token", None)
-        self.fields["token"].widget.attrs["readonly"] = True
-
-    def save(self):
-        """ Saves the form data
-
-        Returns:
-            api_token (APIUserToken)
-        """
-        user = self.instance
-        new_token = self.cleaned_data["token"]
-        if user.api_token is not None:
-            user.api_token.delete()
-        new_token = APIUserToken.objects.create(
-            token=new_token
-        )
-        user.api_token = new_token
-        user.save()
-        return new_token

user/templates/user/token.html

@@ -8,7 +8,16 @@
             <table class="table table-hover">
                 <tr>
                     <th scope="row">{% trans 'Current token' %}</th>
-                    <td>{{ user.api_token.token }}</td>
+                    <td>
+                        <div class="row">
+                            <div class="col-10">{{ user.api_token.token }}</div>
+                            <div class="col-2">
+                                <button class="btn btn-default btn-modal" data-form-url="{% url 'user:api-token-new' %}" title="{% trans 'Create new token' %}">
+                                    {% fa5_icon 'dice' %}
+                                </button>
+                            </div>
+                        </div>
+                    </td>
                 </tr>
                 <tr>
                     <th scope="row">{% trans 'Authenticated by admins' %}</th>
@@ -27,7 +36,9 @@
             </table>
         </div>
     </div>
-    <hr>
-    {% include 'form/table/generic_table_form.html' %}
-
+    
+{% with 'btn-modal' as btn_class %}
+    {% include 'modal/modal_form_script.html' %}
+{% endwith %}
+    
 {% endblock %}

user/tests/unit/test_forms.py

@@ -5,15 +5,14 @@ Contact: ksp-servicestelle@sgdnord.rlp.de
 Created on: 12.09.23
 
 """
-from django.core.exceptions import ObjectDoesNotExist
 from django.test import RequestFactory
 from django.urls import reverse
 from django.utils.translation import gettext_lazy as _
 
-from api.models import APIUserToken
 from konova.tests.test_views import BaseTestCase
+from user.forms.modals.api_token import NewAPITokenModalForm
 from user.forms.modals.team import NewTeamModalForm, EditTeamModalForm, RemoveTeamModalForm, LeaveTeamModalForm
-from user.forms.user import UserNotificationForm, UserAPITokenForm
+from user.forms.user import UserNotificationForm
 from user.models import Team, UserAction, UserNotification
 
 
@@ -252,35 +251,28 @@ class UserNotificationFormTestCase(BaseTestCase):
         self.assertIn(selected_notification, self.user.notifications.all())
 
 
-class UserAPITokenFormTestCase(BaseTestCase):
-    def test_init(self):
-        form = UserAPITokenForm(
-            instance=self.user
-        )
-        self.assertEqual(form.form_title, str(_("Create new token")))
-        self.assertEqual(form.form_caption, str(_("A new token needs to be validated by an administrator!")))
-        self.assertEqual(form.action_url, reverse("user:api-token"))
-        self.assertEqual(form.cancel_redirect, reverse("user:index"))
-
-        self.assertIsNone(form.fields["token"].initial)
-        self.assertTrue(form.fields["token"].widget.attrs["readonly"])
-
-    def test_save(self):
-        data = {
-            "token": APIUserToken().token
+class ApiTokenFormTestCase(BaseTestCase):
+    def test_new_token_and_recreating_token(self):
+        request = RequestFactory().request()
+        request.user = self.user
+        request.POST = {
+            "confirm": True
         }
-        form = UserAPITokenForm(
-            data,
-            instance=self.user
-        )
-        self.assertTrue(form.is_valid(), msg=form.errors)
+
         self.assertIsNone(self.user.api_token)
-        token = form.save()
-        self.assertEqual(self.user.api_token, token)
-        new_token = form.save()
-        self.assertEqual(self.user.api_token, new_token)
-        try:
-            token.refresh_from_db()
-            self.fail("Token should be deleted and not be fetchable anymore")
-        except ObjectDoesNotExist:
-            pass
+        form = NewAPITokenModalForm(request.POST, instance=self.user)
+        form.save()
+        self.user.refresh_from_db()
+        token = self.user.api_token
+        self.assertFalse(token.is_active)
+        self.assertIsNone(token.valid_until)
+        self.assertIsNotNone(token.token)
+
+        old_token = token.token
+        form.save()
+        self.user.refresh_from_db()
+        new_token = self.user.api_token
+        self.assertNotEqual(new_token.token, old_token)
+        self.assertFalse(new_token.is_active)
+        self.assertIsNone(new_token.valid_until)
+

user/urls.py

@@ -9,6 +9,7 @@ from django.urls import path
 
 from user.autocomplete.share import ShareUserAutocomplete, ShareTeamAutocomplete
 from user.autocomplete.team import TeamAdminAutocomplete
+from user.views.api_token import APITokenView, new_api_token_view
 from user.views.propagate import PropagateUserView
 from user.views.views import *
 
@@ -17,7 +18,8 @@ urlpatterns = [
     path("", index_view, name="index"),
     path("propagate/", PropagateUserView.as_view(), name="propagate"),
     path("notifications/", notifications_view, name="notifications"),
-    path("token/api", api_token_view, name="api-token"),
+    path("token/api", APITokenView.as_view(), name="api-token"),
+    path("token/api/new", new_api_token_view, name="api-token-new"),
     path("contact/<id>", contact_view, name="contact"),
     path("team/", index_team_view, name="team-index"),
     path("team/new", new_team_view, name="team-new"),
@@ -30,4 +32,4 @@ urlpatterns = [
     path("atcmplt/share/u", ShareUserAutocomplete.as_view(), name="share-user-autocomplete"),
     path("atcmplt/share/t", ShareTeamAutocomplete.as_view(), name="share-team-autocomplete"),
     path("atcmplt/team/admin", TeamAdminAutocomplete.as_view(), name="team-admin-autocomplete"),
-]
+]

user/views/api_token.py

@@ -0,0 +1,57 @@
+"""
+Author: Michel Peltriaux
+Created on: 08.01.25
+
+"""
+from django.contrib.auth.decorators import login_required
+from django.http import HttpRequest
+from django.shortcuts import render
+from django.urls import reverse
+from django.utils.decorators import method_decorator
+from django.views import View
+from django.utils.translation import gettext_lazy as _
+
+from konova.contexts import BaseContext
+from konova.decorators import default_group_required
+from konova.sub_settings.context_settings import TAB_TITLE_IDENTIFIER
+from konova.utils.message_templates import NEW_API_TOKEN_GENERATED
+from user.forms.modals.api_token import NewAPITokenModalForm
+
+
+class APITokenView(View):
+
+    @method_decorator(login_required)
+    @method_decorator(default_group_required)
+    def dispatch(self, request, *args, **kwargs):
+        return super().dispatch(request, *args, **kwargs)
+
+    def get(self, request: HttpRequest):
+        template = "user/token.html"
+        user = request.user
+
+        context = {
+            "user": user,
+            TAB_TITLE_IDENTIFIER: _("User API token"),
+        }
+        context = BaseContext(request, context).context
+        return render(request, template, context)
+
+
+def new_api_token_view(request: HttpRequest):
+    """ Function based view for processing ModalForm
+    (Currently ModalForms only work properly with function based views)
+
+    Args:
+        request ():
+
+    Returns:
+
+    """
+    user = request.user
+
+    form = NewAPITokenModalForm(request.POST or None, instance=user, request=request)
+    return form.process_request(
+        request=request,
+        msg_success=NEW_API_TOKEN_GENERATED,
+        redirect_url=reverse("user:api-token"),
+    )

user/views/views.py

@@ -3,19 +3,17 @@ from django.contrib.auth.decorators import login_required
 from django.urls import reverse
 
 from konova.sub_settings.context_settings import TAB_TITLE_IDENTIFIER
-from konova.utils.mailer import Mailer
-from konova.utils.message_templates import FORM_INVALID
 from user.forms.modals.team import NewTeamModalForm, EditTeamModalForm, RemoveTeamModalForm, LeaveTeamModalForm
 from user.forms.modals.user import UserContactForm
 from user.forms.team import TeamDataForm
-from user.forms.user import UserNotificationForm, UserAPITokenForm
+from user.forms.user import UserNotificationForm
 from user.models import User, Team
 from django.http import HttpRequest, Http404
 from django.shortcuts import render, redirect, get_object_or_404
 from django.utils.translation import gettext_lazy as _
 
 from konova.contexts import BaseContext
-from konova.decorators import any_group_check, default_group_required, login_required_modal
+from konova.decorators import any_group_check, login_required_modal
 
 
 @login_required
@@ -76,40 +74,6 @@ def notifications_view(request: HttpRequest):
     return render(request, template, context)
 
 
-@login_required
-@default_group_required
-def api_token_view(request: HttpRequest):
-    """ Handles the request for user api frontend settings
-
-    Args:
-        request (HttpRequest): The incoming request
-
-    Returns:
-
-    """
-    template = "user/token.html"
-    user = request.user
-    form = UserAPITokenForm(request.POST or None, instance=user)
-    if request.method == "POST":
-        if form.is_valid():
-            token = form.save()
-            messages.info(request, _("New token generated. Administrators need to validate."))
-            mailer = Mailer()
-            mailer.send_mail_verify_api_token(user)
-            return redirect("user:api-token")
-        else:
-            messages.error(request, FORM_INVALID, extra_tags="danger")
-    elif request.method != "GET":
-        raise NotImplementedError
-    context = {
-        "user": user,
-        "form": form,
-        TAB_TITLE_IDENTIFIER: _("User API token"),
-    }
-    context = BaseContext(request, context).context
-    return render(request, template, context)
-
-
 @login_required_modal
 @login_required
 def contact_view(request: HttpRequest, id: str):