Switch over to a custom user model #207
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Adds in the user model and makes sure the models that reference the user model use the `settings.AUTH_USER_MODEL` method. Creating the migration at this point generates a bunch of errors about groups and permissions, so need to resolve that next - this code won't work as is.
This works best if you trash your existing database. (We're early enough that that shouldn't be a big deal.) - Finalizing changes to the user model and squashing the users migrations down to one - Fixes for the APISIX middleware to check that the user is active, create the user properly when it has to - Set a default for global_id - if we create a manual user, the field needs to be populated, and it's a UUID so no harm in just filling it as per usual - Update the docker_compose env to actually put the Postgres database in a persistent volume, imagine that! - Update the docker_compose env to pull in an init script for Keycloak so you don't have to manually do it - Update the Dockerfile to pull in mitol_django packages you might have built and added manually - no changes to the pyproject.toml for this, you get to do that yourself still - Update gitignore to ignore the mitol_django manual packages
…esn't have an email)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What are the relevant tickets?
Closes mitodl/hq#6597
Description (What does it do?)
Switches the app to use a custom user model, and makes some changes to its copy of the APISIX middleware to handle that (and fix a bug or two).
This adds a user model with a
global_id, which exists to store the SSO ID for the user (Keycloak's UUID, for now). It also changes the APISIX middleware:global_id, and sets theis_activeflag properlyis_activeflag for existing users - if we've turned the user off in Django, they should not be allowed inThe existing app models were changed to reference
settings.AUTH_USER_MODELfor FKs where applicable. I didn't see any additional places where we were referencing theUsermodel directly. This also updates the User Admin in Django Admin to work with the additional fields that are in the new User model.This also fixes a couple of minor things:
mitol_djangopackages that you've built locally so you can test them more easily. (You still have to update the source inpyproject.tomlbefore they'll be used - this just means you can drop the resulting build tarball in the project root and it'll be there when you rebuild the image.)How can this be tested?
All automated tests should pass, and you should be able to use the system as per usual.
Specifically: you should be able to check out successfully. For an admin user, you should be able to promote the user and have them be able to get to the Django Admin successfully. Deactivating a user should deny them access from the system. API calls should work.
Additional Context
Some of these changes are a result of the work in learn-ai - the APISIX middleware stuff will eventually be moved to a reusable ol-django app so this is just further refinement.