Zareian
8835e01595
POST /api/auth/session is gone (404). Existing is_guest rows keep refresh and upgrade-by-phone until the demo/guest rows are purged; the code that serves them is listed in docs/security-before-production.md §10. Tests that used the endpoint as a fixture now use accounts/testing.guest_session. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
23 lines
960 B
Python
23 lines
960 B
Python
from drf_spectacular.extensions import OpenApiAuthenticationExtension
|
|
|
|
|
|
class TadrisinoTokenAuthenticationScheme(OpenApiAuthenticationExtension):
|
|
"""
|
|
این کلاس به drf-spectacular میگه که TadrisinoTokenAuthentication یک
|
|
Bearer token هست، تا دکمهی "Authorize" توی Swagger UI درست نمایش داده بشه.
|
|
"""
|
|
target_class = 'accounts.authentication.TadrisinoTokenAuthentication'
|
|
name = 'BearerAuth'
|
|
|
|
def get_security_definition(self, auto_schema):
|
|
return {
|
|
'type': 'http',
|
|
'scheme': 'bearer',
|
|
'bearerFormat': 'access_token',
|
|
'description': (
|
|
'توکن دسترسی که از /api/auth/login گرفته میشه. '
|
|
'در فیلد Value فقط خودِ توکن رو بذارید (بدون کلمهی Bearer)؛ Swagger '
|
|
'خودش اضافه میکنه.'
|
|
),
|
|
}
|