feat(auth): store actual user ID on task actions (#94)

* feat: add auth logic for all the APIs

* refactor: serializer and repositories tests

* refactor: integration test for auth logic

* refactor: unit tests for auth logic

* fix: remove csrf disable middleware

* refactor: move user setup and auth cookies to shared test utility

* fix: add createdBy validator

Author: AnujChhikara

todo/constants/messages.py

@@ -41,6 +41,9 @@ class ApiErrors:
     TOKEN_REFRESH_FAILED = "Token refresh failed: {0}"
     LOGOUT_FAILED = "Logout failed: {0}"
     STATE_CONFLICT_TITLE = "State Conflict"
+    UNAUTHORIZED_TITLE = "You are not authorized to perform this action"
+    USER_NOT_FOUND = "User with ID {0} not found."
+    USER_NOT_FOUND_GENERIC = "User not found."
 
 
 # Validation error messages

todo/dto/task_dto.py

@@ -1,7 +1,9 @@
 from datetime import datetime
 from typing import List
+from bson import ObjectId
 from pydantic import BaseModel, field_validator
 
+from todo.constants.messages import ValidationErrors
 from todo.constants.task import TaskPriority, TaskStatus
 from todo.dto.deferred_details_dto import DeferredDetailsDTO
 from todo.dto.label_dto import LabelDTO
@@ -38,6 +40,7 @@ class CreateTaskDTO(BaseModel):
     assignee: str | None = None
     labels: List[str] = []
     dueAt: datetime | None = None
+    createdBy: str
 
     @field_validator("priority", mode="before")
     def parse_priority(cls, value):
@@ -50,3 +53,9 @@ def parse_status(cls, value):
         if isinstance(value, str):
             return TaskStatus[value]
         return value
+
+    @field_validator("createdBy")
+    def validate_created_by(cls, value: str) -> str:
+        if not ObjectId.is_valid(value):
+            raise ValueError(ValidationErrors.INVALID_OBJECT_ID.format(value))
+        return value

todo/exceptions/exception_handler.py

@@ -14,6 +14,7 @@
     UnprocessableEntityException,
     TaskStateConflictException,
 )
+from todo.exceptions.user_exceptions import UserNotFoundException
 from .auth_exceptions import TokenExpiredError, TokenMissingError, TokenInvalidError
 from .google_auth_exceptions import (
     GoogleAuthException,
@@ -48,6 +49,7 @@ def format_validation_errors(errors) -> List[ApiErrorDetail]:
 def handle_exception(exc, context):
     response = drf_exception_handler(exc, context)
     task_id = context.get("kwargs", {}).get("task_id")
+    user_id = context.get("kwargs", {}).get("user_id")
 
     error_list = []
     status_code = status.HTTP_500_INTERNAL_SERVER_ERROR
@@ -187,6 +189,26 @@ def handle_exception(exc, context):
                 detail=str(exc),
             )
         )
+
+    elif isinstance(exc, UserNotFoundException):
+        status_code = status.HTTP_404_NOT_FOUND
+        error_list.append(
+            ApiErrorDetail(
+                source={ApiErrorSource.PATH: "user_id"} if user_id else None,
+                title=ApiErrors.RESOURCE_NOT_FOUND_TITLE,
+                detail=str(exc),
+            )
+        )
+
+    elif isinstance(exc, PermissionError):
+        status_code = status.HTTP_403_FORBIDDEN
+        error_list.append(
+            ApiErrorDetail(
+                title=ApiErrors.UNAUTHORIZED_TITLE if hasattr(ApiErrors, "UNAUTHORIZED_TITLE") else "Permission Denied",
+                detail=str(exc),
+            )
+        )
+
     elif isinstance(exc, UnprocessableEntityException):
         status_code = status.HTTP_422_UNPROCESSABLE_ENTITY
         determined_message = str(exc)

todo/exceptions/user_exceptions.py

@@ -0,0 +1,13 @@
+from todo.constants.messages import ApiErrors
+
+
+class UserNotFoundException(Exception):
+    def __init__(self, user_id: str | None = None, message_template: str = ApiErrors.USER_NOT_FOUND):
+        if user_id:
+            try:
+                self.message = message_template.format(user_id)
+            except (KeyError, ValueError):
+                self.message = f"{message_template} (ID: {user_id})"
+        else:
+            self.message = ApiErrors.USER_NOT_FOUND_GENERIC
+        super().__init__(self.message)

todo/repositories/task_repository.py

@@ -3,9 +3,10 @@
 from bson import ObjectId
 from pymongo import ReturnDocument
 
+from todo.exceptions.task_exceptions import TaskNotFoundException
 from todo.models.task import TaskModel
 from todo.repositories.common.mongo_repository import MongoRepository
-from todo.constants.messages import RepositoryErrors
+from todo.constants.messages import ApiErrors, RepositoryErrors
 
 
 class TaskRepository(MongoRepository):
@@ -32,6 +33,7 @@ def get_all(cls) -> List[TaskModel]:
         """
         tasks_collection = cls.get_collection()
         tasks_cursor = tasks_collection.find()
+
         return [TaskModel(**task) for task in tasks_cursor]
 
     @classmethod
@@ -85,17 +87,30 @@ def get_by_id(cls, task_id: str) -> TaskModel | None:
         return None
 
     @classmethod
-    def delete_by_id(cls, task_id: str) -> TaskModel | None:
+    def delete_by_id(cls, task_id: ObjectId, user_id: str) -> TaskModel | None:
         tasks_collection = cls.get_collection()
 
+        task = tasks_collection.find_one({"_id": task_id, "isDeleted": False})
+        if not task:
+            raise TaskNotFoundException(task_id)
+
+        assignee_id = task.get("assignee")
+
+        if assignee_id:
+            if assignee_id != user_id:
+                raise PermissionError(ApiErrors.UNAUTHORIZED_TITLE)
+        else:
+            if user_id != task.get("createdBy"):
+                raise PermissionError(ApiErrors.UNAUTHORIZED_TITLE)
+
         deleted_task_data = tasks_collection.find_one_and_update(
-            {"_id": task_id, "isDeleted": False},
+            {"_id": task_id},
             {
                 "$set": {
                     "isDeleted": True,
                     "updatedAt": datetime.now(timezone.utc),
-                    "updatedBy": "system",
-                }  # TODO: modify to use actual user after auth implementation,
+                    "updatedBy": user_id,
+                }
             },
             return_document=ReturnDocument.AFTER,
         )

todo/serializers/create_task_serializer.py

@@ -45,6 +45,8 @@ def validate_dueAt(self, value):
         return value
 
     def validate_assignee(self, value):
-        if isinstance(value, str) and not value.strip():
+        if not value or not value.strip():
             return None
+        if not ObjectId.is_valid(value):
+            raise serializers.ValidationError(ValidationErrors.INVALID_OBJECT_ID.format(value))
         return value

todo/serializers/update_task_serializer.py

@@ -66,6 +66,8 @@ def validate_startedAt(self, value):
         return value
 
     def validate_assignee(self, value):
-        if isinstance(value, str) and not value.strip():
+        if not value or not value.strip():
             return None
+        if not ObjectId.is_valid(value):
+            raise serializers.ValidationError(ValidationErrors.INVALID_OBJECT_ID.format(value))
         return value

todo/services/task_service.py

@@ -14,6 +14,7 @@
 from todo.dto.responses.create_task_response import CreateTaskResponse
 from todo.dto.responses.error_response import ApiErrorResponse, ApiErrorDetail, ApiErrorSource
 from todo.dto.responses.paginated_response import LinksData
+from todo.exceptions.user_exceptions import UserNotFoundException
 from todo.models.task import TaskModel, DeferredDetailsModel
 from todo.models.common.pyobjectid import PyObjectId
 from todo.repositories.task_repository import TaskRepository
@@ -28,6 +29,8 @@
 )
 from bson.errors import InvalidId as BsonInvalidId
 
+from todo.repositories.user_repository import UserRepository
+
 
 @dataclass
 class PaginationConfig:
@@ -112,9 +115,8 @@ def build_page_url(cls, page: int, limit: int) -> str:
     @classmethod
     def prepare_task_dto(cls, task_model: TaskModel) -> TaskDTO:
         label_dtos = cls._prepare_label_dtos(task_model.labels) if task_model.labels else []
-
         assignee = cls.prepare_user_dto(task_model.assignee) if task_model.assignee else None
-        created_by = cls.prepare_user_dto(task_model.createdBy)
+        created_by = cls.prepare_user_dto(task_model.createdBy) if task_model.createdBy else None
         updated_by = cls.prepare_user_dto(task_model.updatedBy) if task_model.updatedBy else None
         deferred_details = (
             cls.prepare_deferred_details_dto(task_model.deferredDetails) if task_model.deferredDetails else None
@@ -172,7 +174,10 @@ def prepare_deferred_details_dto(cls, deferred_details_model: DeferredDetailsMod
 
     @classmethod
     def prepare_user_dto(cls, user_id: str) -> UserDTO:
-        return UserDTO(id=user_id, name="SYSTEM")
+        user = UserRepository.get_by_id(user_id)
+        if user:
+            return UserDTO(id=str(user_id), name=user.name)
+        raise UserNotFoundException(user_id)
 
     @classmethod
     def get_task_by_id(cls, task_id: str) -> TaskDTO:
@@ -208,11 +213,23 @@ def _process_enum_for_update(cls, enum_type: type, value: str | None) -> str | N
         return enum_type[value].value
 
     @classmethod
-    def update_task(cls, task_id: str, validated_data: dict, user_id: str = "system") -> TaskDTO:
+    def update_task(cls, task_id: str, validated_data: dict, user_id: str) -> TaskDTO:
         current_task = TaskRepository.get_by_id(task_id)
+
         if not current_task:
             raise TaskNotFoundException(task_id)
 
+        if current_task.assignee and current_task.assignee != user_id:
+            raise PermissionError(ApiErrors.UNAUTHORIZED_TITLE)
+
+        if not current_task.assignee and current_task.createdBy != user_id:
+            raise PermissionError(ApiErrors.UNAUTHORIZED_TITLE)
+
+        if validated_data.get("assignee"):
+            assignee_data = UserRepository.get_by_id(validated_data["assignee"])
+            if not assignee_data:
+                raise UserNotFoundException(validated_data["assignee"])
+
         update_payload = {}
         enum_fields = {"priority": TaskPriority, "status": TaskStatus}
 
@@ -238,9 +255,16 @@ def update_task(cls, task_id: str, validated_data: dict, user_id: str = "system"
     @classmethod
     def defer_task(cls, task_id: str, deferred_till: datetime, user_id: str) -> TaskDTO:
         current_task = TaskRepository.get_by_id(task_id)
+
         if not current_task:
             raise TaskNotFoundException(task_id)
 
+        if current_task.assignee and current_task.assignee != user_id:
+            raise PermissionError(ApiErrors.UNAUTHORIZED_TITLE)
+
+        if not current_task.assignee and current_task.createdBy != user_id:
+            raise PermissionError(ApiErrors.UNAUTHORIZED_TITLE)
+
         if current_task.status == TaskStatus.DONE:
             raise TaskStateConflictException(ValidationErrors.CANNOT_DEFER_A_DONE_TASK)
 
@@ -284,6 +308,11 @@ def create_task(cls, dto: CreateTaskDTO) -> CreateTaskResponse:
         now = datetime.now(timezone.utc)
         started_at = now if dto.status == TaskStatus.IN_PROGRESS else None
 
+        if dto.assignee:
+            assignee = UserRepository.get_by_id(dto.assignee)
+            if not assignee:
+                raise UserNotFoundException(dto.assignee)
+
         if dto.labels:
             existing_labels = LabelRepository.list_by_ids(dto.labels)
             if len(existing_labels) != len(dto.labels):
@@ -317,7 +346,7 @@ def create_task(cls, dto: CreateTaskDTO) -> CreateTaskResponse:
             createdAt=now,
             isAcknowledged=False,
             isDeleted=False,
-            createdBy="system",  # placeholder, will be user_id when auth is in place
+            createdBy=dto.createdBy,  # placeholder, will be user_id when auth is in place
         )
 
         try:
@@ -356,8 +385,8 @@ def create_task(cls, dto: CreateTaskDTO) -> CreateTaskResponse:
             )
 
     @classmethod
-    def delete_task(cls, task_id: str) -> None:
-        deleted_task_model = TaskRepository.delete_by_id(task_id)
+    def delete_task(cls, task_id: str, user_id: str) -> None:
+        deleted_task_model = TaskRepository.delete_by_id(task_id, user_id)
         if deleted_task_model is None:
             raise TaskNotFoundException(task_id)
         return None

todo/tests/fixtures/label.py

@@ -8,14 +8,14 @@
         "name": "Label 1",
         "color": "#fa1e4e",
         "createdAt": "2024-11-08T10:14:35",
-        "createdBy": "qMbT6M2GB65W7UHgJS4g",
+        "createdBy": str(ObjectId()),
     },
     {
         "_id": ObjectId("67588c1ac2195684a575840c"),
         "name": "Label 2",
         "color": "#ea1e4e",
         "createdAt": "2024-11-08T10:14:35",
-        "createdBy": "qMbT6M2GB65W7UHgJS4g",
+        "createdBy": str(ObjectId()),
     },
 ]
 

todo/tests/fixtures/user.py

@@ -1,5 +1,7 @@
 from datetime import datetime, timezone
 
+from bson import ObjectId
+
 users_db_data = [
     {
         "google_id": "123456789",
@@ -16,3 +18,10 @@
         "updated_at": datetime.now(timezone.utc),
     },
 ]
+
+google_auth_user_payload = {
+    "user_id": str(ObjectId()),
+    "google_id": "test_google_id",
+    "email": "[email protected]",
+    "name": "Test User",
+}