Password resetting

src/accounts/api/serializers.py

@@ -1,9 +1,12 @@
+import secrets
+import uuid
 from django.conf import settings
 from django.contrib.auth import authenticate
 from django_email_verification import sendConfirm
 from rest_framework import serializers
+from django.utils import timezone
 
-from ..models import Account
+from ..models import (Account, PasswordResetRequestModel)
 
 
 class PublicAccountDataSerializer(serializers.ModelSerializer):
@@ -81,3 +84,33 @@ def validate(self, data):
                 "Verification token seems invalid or maybe outdated. Try requesting a new one."
             )
         return account
+
+class ResetPasswordSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = Account
+        fields = ("password",)
+        extra_kwargs = {"password": {"write_only": True}}
+
+
+class ResetPasswordRequestSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = PasswordResetRequestModel
+        fields = ["email"]
+
+    email = serializers.EmailField()
+
+    def validate(self, data):
+        email = data.get("email")
+        account = Account.objects.filter(email=email).first()
+        # Note: Make this silently fail later; users don't need to know about this.
+        if account is None:
+            raise serializers.ValidationError("Account with this email doesn't exist.")
+
+        # Create a new instance of PasswordResetRequestModel using the account's verification token
+        token = secrets.token_urlsafe(32)
+        new_model_data = {"token": token, "account": account, "created_at": timezone.now() + timezone.timedelta(minutes=35)}
+        return new_model_data
+
+    def create(self, validated_data):
+        reset_request = PasswordResetRequestModel.objects.create(**validated_data)
+        return reset_request

src/accounts/api/urls.py

@@ -9,6 +9,8 @@
     RequestVerificationTokenView,
     UpdateAccountView,
     VerifyAccountView,
+    ChangePasswordView,
+    RequestPasswordResetView,
 )
 
 app_name = "account"
@@ -32,4 +34,6 @@
         name="request-verification-token",
     ),
     path("verify-account", VerifyAccountView.as_view(), name="verify-account"),
+    path("reset-password/<str:reset_token>", ChangePasswordView.as_view(), name="change-passwordd"),
+    path("reset-password/", RequestPasswordResetView.as_view(), name="change-password"),
 ]

src/accounts/api/views.py

@@ -17,6 +17,9 @@
     RegisterAccountSerializer,
     UpdateAccountSerializer,
     VerifyAccountSerializer,
+    ResetPasswordSerializer,
+    ResetPasswordRequestSerializer,
+    PasswordResetRequestModel,
 )
 
 
@@ -181,3 +184,43 @@ def post(self, request):
         public_data = PublicAccountDataSerializer(account).data
 
         return Response(public_data, status=status.HTTP_200_OK)
+
+class ResetPasswordView(GenericAPIView):
+    permission_classes = (AllowAny,)
+    serializer_class = ResetPasswordSerializer
+
+    def post(self, request, reset_token):
+        serializer = self.serializer_class(data=request.data)
+        print(str(reset_token))
+        try:
+            if serializer.is_valid(raise_exception=True):
+                reset_request = PasswordResetRequestModel.objects.get(token=reset_token)
+                if not reset_request.is_token_valid():
+                    return Response({'error': 'Invalid link or expired.'}, status=status.HTTP_400_BAD_REQUEST)
+                account = reset_request.account
+                account.set_password(serializer.validated_data["password"])
+                account.save()
+                reset_request.delete()
+                return Response(data={"detail": "Changed password succesfully"}, status=status.HTTP_200_OK)
+            else:
+                return Response({'error': 'Invalid link or expired.'}, status=status.HTTP_400_BAD_REQUEST)
+        except (TypeError, ValueError, OverflowError, PasswordResetRequestModel.DoesNotExist):
+            return Response({'error': 'Invalid link or expired.'}, status=status.HTTP_400_BAD_REQUEST)
+
+        return Response({"detail": "Operation Done."}, status=status.HTTP_200_OK)
+
+class RequestPasswordResetView(GenericAPIView):
+    permission_classes = (AllowAny,)
+    serializer_class = ResetPasswordRequestSerializer
+
+    def post(self, request):
+        serializer = self.serializer_class(data=request.data)
+        try:
+            serializer.is_valid(raise_exception=True)
+        except Exception as e:
+            # Don't tell the user about the error, just move on.
+            print(str(e))
+            return Response(data={"detail": "Operation Done."}, status=status.HTTP_200_OK)
+
+        serializer.save()
+        return Response(data={"detail": "Operation Done."}, status=status.HTTP_200_OK)

src/accounts/migrations/0002_passwordresetrequest.py

@@ -0,0 +1,23 @@
+# Generated by Django 3.2.22 on 2024-01-13 17:03
+
+from django.conf import settings
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounts', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='PasswordResetRequest',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('token', models.UUIDField()),
+                ('account', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL)),
+            ],
+        ),
+    ]

src/accounts/migrations/0003_auto_20240113_1858.py

@@ -0,0 +1,26 @@
+# Generated by Django 3.2.22 on 2024-01-13 18:58
+
+from django.conf import settings
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounts', '0002_passwordresetrequest'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='PasswordResetRequestModel',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('token', models.UUIDField()),
+                ('account', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL)),
+            ],
+        ),
+        migrations.DeleteModel(
+            name='PasswordResetRequest',
+        ),
+    ]

src/accounts/migrations/0004_alter_passwordresetrequestmodel_token.py

@@ -0,0 +1,18 @@
+# Generated by Django 3.2.22 on 2024-01-18 20:03
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounts', '0003_auto_20240113_1858'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='passwordresetrequestmodel',
+            name='token',
+            field=models.TextField(),
+        ),
+    ]

src/accounts/migrations/0005_passwordresetrequestmodel_expiry_datetime.py

@@ -0,0 +1,20 @@
+# Generated by Django 3.2.22 on 2024-01-18 20:40
+
+from django.db import migrations, models
+import django.utils.timezone
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounts', '0004_alter_passwordresetrequestmodel_token'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='passwordresetrequestmodel',
+            name='expiry_datetime',
+            field=models.DateTimeField(default=django.utils.timezone.now),
+            preserve_default=False,
+        ),
+    ]

src/accounts/migrations/0006_auto_20240118_2053.py

@@ -0,0 +1,24 @@
+# Generated by Django 3.2.22 on 2024-01-18 20:53
+
+from django.db import migrations, models
+import django.utils.timezone
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounts', '0005_passwordresetrequestmodel_expiry_datetime'),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name='passwordresetrequestmodel',
+            name='expiry_datetime',
+        ),
+        migrations.AddField(
+            model_name='passwordresetrequestmodel',
+            name='created_at',
+            field=models.DateTimeField(auto_now_add=True, default=django.utils.timezone.now),
+            preserve_default=False,
+        ),
+    ]

src/accounts/models.py

@@ -1,3 +1,5 @@
+from datetime import timedelta
+from django.utils import timezone
 from uuid import uuid4
 
 from django.contrib.auth.models import AbstractUser
@@ -69,3 +71,11 @@ def save(self, *args, **kwargs):
 
     def __str__(self):
         return f"{self.unique_identifier} as {self.username}"
+
+class PasswordResetRequestModel(models.Model):
+    token = models.TextField()
+    account = models.ForeignKey(Account, on_delete=models.CASCADE)
+    created_at = models.DateTimeField(auto_now_add=True)
+
+    def is_token_valid(self):
+        return timezone.now() <= timedelta(minutes=60)