exler/dome
exler/dome
Watch
1
0
Fork
You've already forked dome
 0
Code Issues Pull requests Releases Packages 1 Activity Actions

feat: add public media tracking API #1

Merged
exler merged 2 commits from feat/public-api-tokens into main 2026-09-12 09:21:08 +02:00
Conversation 1 Commits 2 Files changed 23 +1422 -5
camila commented 2026-09-12 00:11:52 +02:00
Collaborator
Copy link

Summary

  • Add user-managed opaque bearer API tokens with expiry and revocation.
  • Add an API Tokens page in the user menu; plaintext tokens are shown exactly once and never stored.
  • Implement the public media tracking API with django-modern-rest 0.15, typed msgspec request/response schemas, DMR bearer authentication, and generated OpenAPI documentation.
  • Deliberately omit every media import, creation, deletion, and external-provider operation.

API

  • GET /api/v1/entities/?type=movies&q=matrix
  • GET /api/v1/entities/movies/1/
  • PATCH /api/v1/entities/movies/1/tracking/ with {"status": "completed"}
  • GET /api/v1/openapi.json
  • GET /api/v1/docs/

Security

  • Bearer token is the exclusive API authentication mechanism; Django session authentication is not accepted.
  • Tokens are opaque, generated cryptographically, and stored only as a hash plus a non-secret prefix.
  • Expired, revoked, malformed, and missing tokens return JSON 401 responses.
  • Tracking data and mutations are always scoped to the authenticated token owner.

Validation

  • manage.py test users.tests api.tests — 45 tests passed
  • manage.py check
  • manage.py makemigrations --check --dry-run
  • Ruff for changed source modules
  • git diff --check

Known environment limitation

  • nub was unavailable on the development host, so frontend compilation and visual screenshot QA could not be run.
## Summary - Add user-managed opaque bearer API tokens with expiry and revocation. - Add an API Tokens page in the user menu; plaintext tokens are shown exactly once and never stored. - Implement the public media tracking API with **django-modern-rest 0.15**, typed `msgspec` request/response schemas, DMR bearer authentication, and generated OpenAPI documentation. - Deliberately omit every media import, creation, deletion, and external-provider operation. ## API - `GET /api/v1/entities/?type=movies&q=matrix` - `GET /api/v1/entities/movies/1/` - `PATCH /api/v1/entities/movies/1/tracking/` with `{"status": "completed"}` - `GET /api/v1/openapi.json` - `GET /api/v1/docs/` ## Security - Bearer token is the exclusive API authentication mechanism; Django session authentication is not accepted. - Tokens are opaque, generated cryptographically, and stored only as a hash plus a non-secret prefix. - Expired, revoked, malformed, and missing tokens return JSON 401 responses. - Tracking data and mutations are always scoped to the authenticated token owner. ## Validation - `manage.py test users.tests api.tests` — 45 tests passed - `manage.py check` - `manage.py makemigrations --check --dry-run` - Ruff for changed source modules - `git diff --check` ## Known environment limitation - `nub` was unavailable on the development host, so frontend compilation and visual screenshot QA could not be run.
refactor: use django-modern-rest for public API
Some checks failed
Push Docker Image / push (push) Has been cancelled
Details
6897edc075
exler approved these changes 2026-09-12 09:21:00 +02:00
exler merged commit 6897edc075 into main 2026-09-12 09:21:08 +02:00
exler deleted branch feat/public-api-tokens 2026-09-12 09:21:08 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
exler
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
exler/dome!1
No description provided.