reset password

Author: rockstarr-programmerr

account/business/reset_password.py

@@ -0,0 +1,57 @@
+from django.conf import settings
+from django.contrib.auth import get_user_model
+from django.contrib.auth.tokens import PasswordResetTokenGenerator
+from django.core.exceptions import ValidationError
+from django.utils.encoding import force_bytes
+from django.utils.http import urlsafe_base64_decode, urlsafe_base64_encode
+
+from account.serializers import EmailResetPasswordLinkTaskSerializer
+from account.tasks import send_email_reset_password_link_task
+from keep_learning.utils.url import update_url_params
+
+User = get_user_model()
+
+
+class ResetPasswordTokenInvalid(Exception):
+    pass
+
+
+class ResetPasswordBusiness:
+    token_generator = PasswordResetTokenGenerator()
+
+    def __init__(self, user):
+        self.user = user
+
+    def send_email(self):
+        url = self.get_link()
+        serializer = EmailResetPasswordLinkTaskSerializer(instance=self.user)
+        send_email_reset_password_link_task.delay(serializer.data, url)
+
+    def reset_password(self, password, token):
+        self.check_token(token)
+        self.user.set_password(password)
+        self.user.save()
+
+    def get_link(self):
+        token = self.token_generator.make_token(self.user)
+        uid = urlsafe_base64_encode(force_bytes(self.user.pk))
+        url = update_url_params(settings.WEB_RESET_PASSWORD_URL, {'token': token, 'uid': uid})
+        return url
+
+    def check_token(self, token):
+        is_valid = self.token_generator.check_token(self.user, token)
+        if not is_valid:
+            raise ResetPasswordTokenInvalid
+
+    @staticmethod
+    def get_user_by_email(email):
+        return User.objects.filter(email=email).first()
+
+    @staticmethod
+    def get_user_by_uid(uid):
+        try:
+            uid = urlsafe_base64_decode(uid).decode()
+            user = User.objects.get(pk=uid)
+        except (TypeError, ValueError, OverflowError, User.DoesNotExist, ValidationError):
+            user = None
+        return user

account/serializers.py

@@ -65,4 +65,20 @@ class MeSerializer(UserSerializer):
 
 class ChangePasswordSerializer(serializers.Serializer):
     current_password = serializers.CharField(write_only=True)
+
+
+class EmailResetPasswordLinkSerializer(serializers.Serializer):
+    email = serializers.EmailField()
+
+
+class ResetPasswordSerializer(serializers.Serializer):
+    uid = serializers.CharField()
+    token = serializers.CharField()
+    password = serializers.CharField(write_only=True, validators=[validate_password])
     new_password = serializers.CharField(write_only=True, validators=[validate_password])
+
+
+class EmailResetPasswordLinkTaskSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = User
+        fields = ['name', 'email', 'date_joined']

account/tasks.py

@@ -0,0 +1,28 @@
+from celery import shared_task
+from dateutil.parser import isoparse
+from django.core.mail import send_mail
+from django.template import loader
+from django.utils import formats
+from django.utils.translation import gettext_lazy as _
+
+
+@shared_task
+def send_email_reset_password_link_task(recipient, url):
+    return send_email_reset_password_link(recipient, url)
+
+def send_email_reset_password_link(recipient, url):
+    date_joined = recipient['date_joined']
+    date_joined_dt = isoparse(date_joined)
+    date_joined_str = formats.localize(date_joined_dt)
+    recipient['date_joined'] = date_joined_str
+
+    context = {
+        'url': url,
+        'recipient': recipient,
+        'app_name': _('Tango'),
+    }
+    title = loader.render_to_string('account/reset_password/email_title.txt', context)
+    title = title.replace('\n', '')  # Title cannot have newline
+    message = loader.render_to_string('account/reset_password/email_body.txt', context)
+    html_message = loader.render_to_string('account/reset_password/email_body.html', context)
+    send_mail(title, message, None, [recipient['email']], html_message=html_message)

account/templates/account/reset_password/email_body.html

@@ -0,0 +1,26 @@
+{% load i18n %}
+{% autoescape off %}
+
+<h1>{% translate 'Hi there' %} :)</h1>
+
+{% blocktranslate %}
+<p>You're receiving this email because you requested a password reset for your user account at <b>{{ app_name }}</b>.</p>
+{% endblocktranslate %}
+
+<p>{% translate "Please click this link and then follow the instruction to reset your password:" %}</p>
+<a href="{{ url }}">{{ url }}</a>
+
+<p>{% translate 'Your account information:' %}</p>
+<ul>
+    <li>{% translate 'Name' %}: {{ recipient.name }}</li>
+    <li>{% translate 'Email' %}: {{ recipient.email }}</li>
+    <li>{% translate 'Date joined' %}: {{ recipient.date_joined }}</li>
+</ul>
+
+<p>{% translate "Thanks for using our app!" %}</p>
+
+{% blocktranslate %}
+<p>The <b>{{ app_name }}</b> team.</p>
+{% endblocktranslate %}
+
+{% endautoescape %}

account/templates/account/reset_password/email_body.txt

@@ -0,0 +1,24 @@
+{% load i18n %}
+{% autoescape off %}
+
+{% translate 'Hi there' %} :)
+
+{% blocktranslate %}
+You're receiving this email because you requested a password reset for your user account at {{ app_name }}.
+{% endblocktranslate %}
+
+{% translate "Please click this link and then follow the instruction to reset your password:" %}
+{{ url }}
+
+{% translate 'Your account information:' %}
+{% translate 'Name' %}: {{ recipient.name }}
+{% translate 'Email' %}: {{ recipient.email }}
+{% translate 'Date joined' %}: {{ recipient.date_joined }}
+
+{% translate "Thanks for using our app!" %}
+
+{% blocktranslate %}
+The {{ app_name }} team
+{% endblocktranslate %}
+
+{% endautoescape %}

account/templates/account/reset_password/email_title.txt

@@ -0,0 +1,8 @@
+{% load i18n %}
+{% autoescape off %}
+
+{% blocktranslate %}
+Password reset on {{ app_name }}
+{% endblocktranslate %}
+
+{% endautoescape %}

account/views.py

@@ -2,17 +2,21 @@
 from django.utils.decorators import classonlymethod, method_decorator
 from django.utils.translation import gettext as _
 from django.views.decorators.debug import sensitive_post_parameters
-from rest_framework import mixins
+from rest_framework import mixins, status
 from rest_framework.decorators import action
-from rest_framework.exceptions import PermissionDenied
+from rest_framework.exceptions import NotFound, PermissionDenied
 from rest_framework.generics import get_object_or_404
 from rest_framework.permissions import AllowAny
 from rest_framework.response import Response
 from rest_framework.viewsets import GenericViewSet
 
 from account import business
-from account.serializers import (ChangePasswordSerializer, MeSerializer,
-                                 RegisterTeacherSerializer, UserSerializer)
+from account.business.reset_password import (ResetPasswordBusiness,
+                                             ResetPasswordTokenInvalid)
+from account.serializers import (ChangePasswordSerializer,
+                                 EmailResetPasswordLinkSerializer,
+                                 MeSerializer, RegisterTeacherSerializer,
+                                 ResetPasswordSerializer, UserSerializer)
 
 User = get_user_model()
 
@@ -88,6 +92,57 @@ def change_password(self, request):
         user.save()
         return Response()
 
+    @action(
+        detail=False, methods=['POST'],
+        url_path='email-reset-password-link',
+        serializer_class=EmailResetPasswordLinkSerializer,
+        permission_classes=[AllowAny],
+    )
+    def email_reset_password_link(self, request):
+        """
+        Send reset password link email.
+        """
+        serializer = self.get_serializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+        email = serializer.validated_data['email']
+
+        user = ResetPasswordBusiness.get_user_by_email(email)
+        if user:
+            business = ResetPasswordBusiness(user)
+            business.send_email()
+
+        return Response(status=status.HTTP_202_ACCEPTED)
+
+    @action(
+        detail=False, methods=['POST'],
+        url_path='reset-password',
+        serializer_class=ResetPasswordSerializer,
+        permission_classes=[AllowAny],
+    )
+    def reset_password(self, request):
+        """
+        Reset user's password.
+        Return 403 if `token` is not valid.
+        Return 404 if `uid` is not valid.
+        """
+        serializer = self.get_serializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+        uid = serializer.validated_data['uid']
+        token = serializer.validated_data['token']
+        password = serializer.validated_data['password']
+
+        user = ResetPasswordBusiness.get_user_by_uid(uid)
+        if user:
+            business = ResetPasswordBusiness(user)
+            try:
+                business.reset_password(password, token)
+            except ResetPasswordTokenInvalid:
+                raise PermissionDenied(_('Reset password token invalid.'))
+        else:
+            raise NotFound(_('Cannot find user with the given `uid`.'))
+
+        return Response()
+
 
 class MeViewSet(mixins.ListModelMixin,
                 mixins.RetrieveModelMixin,

classroom/tasks.py

@@ -35,7 +35,6 @@ def send_temp_password_for_new_students(student_emails, temp_passwords, teacher_
             alternatives=[
                 (html_message, 'text/html')
             ],
-            from_email='rockstarrprogrammerr@gmail.com',
             to=[student_email],
         )
         messages.append(message)

keep_learning/settings.py

@@ -56,7 +56,8 @@
     DEFAULT_FROM_EMAIL=(str, ''),
 
     CELERY_BROKER_URL=(str, 'amqp://kl_user:kl_password@localhost:5672/kl_vhost'),
-    WEB_LOGIN_URL=(str, 'http://localhost:8080/login/')
+    WEB_LOGIN_URL=(str, 'http://localhost:8080/login'),
+    WEB_RESET_PASSWORD_URL=(str, 'http://localhost:8080/new-password'),
 )
 # reading .env file
 env_file = str(BASE_DIR / '.env')
@@ -281,5 +282,6 @@
         del REST_FRAMEWORK['DEFAULT_THROTTLE_RATES']
 
 WEB_LOGIN_URL = env('WEB_LOGIN_URL')
+WEB_RESET_PASSWORD_URL = env('WEB_RESET_PASSWORD_URL')
 
 MAX_UPLOAD_SIZE_MEGABYTES = 10

keep_learning/utils/url.py

@@ -0,0 +1,25 @@
+from urllib.parse import urlparse, unquote, urlencode, parse_qsl, ParseResult
+
+
+def get_url_params(url):
+    url = unquote(url)
+    p_url = urlparse(url)
+    p_qs = parse_qsl(p_url.query)
+    p_params = dict(p_qs)
+    return p_params
+
+
+def update_url_params(url, new_params):
+    url = unquote(url)
+    p_url = urlparse(url)
+    p_qs = parse_qsl(p_url.query)
+    p_params = dict(p_qs)
+    p_params.update(new_params)
+    encoded_params = urlencode(p_params, doseq=True)
+
+    new_url = ParseResult(
+        p_url.scheme, p_url.netloc, p_url.path,
+        p_url.params, encoded_params, p_url.fragment
+    ).geturl()
+
+    return new_url