35 lines
1.4 KiB
Python
35 lines
1.4 KiB
Python
"""Test-only username/password login.
|
|
|
|
Lets load-testing tools (see loadtest/locustfile.py) authenticate local
|
|
Django accounts through AUTHENTICATION_BACKENDS' ModelBackend, entirely
|
|
bypassing SimpleCASBackend - so hammering this app under load never sends a
|
|
single request to the real CAS server at polylan.ch.
|
|
|
|
Only wired up in urls.py when settings.LOAD_TEST_LOGIN_ENABLED is true, and
|
|
that must stay off in production: it lets anyone who knows a local test
|
|
account's password log in without going through CAS at all. The "Create
|
|
load test users" admin action on CustomUser (see accounts/admin.py) is
|
|
hidden unless that same flag is set, as a second layer of the same guard
|
|
rail.
|
|
"""
|
|
|
|
from django.contrib.auth import authenticate, login
|
|
from django.http import HttpRequest, JsonResponse
|
|
from django.utils.decorators import method_decorator
|
|
from django.views import View
|
|
from django.views.decorators.csrf import csrf_exempt
|
|
|
|
|
|
@method_decorator(csrf_exempt, name="dispatch")
|
|
class TestLoginView(View):
|
|
def post(self, request: HttpRequest):
|
|
username = request.POST.get("username")
|
|
password = request.POST.get("password")
|
|
|
|
user = authenticate(request, username=username, password=password)
|
|
if user is None:
|
|
return JsonResponse({"detail": "invalid credentials"}, status=401)
|
|
|
|
login(request, user)
|
|
return JsonResponse({"detail": "ok"})
|