First implementation working

plant_catalog/catalog/api_views.py

@@ -1,8 +1,10 @@
 # catalog/api_views.py
 
 from rest_framework import generics
-from rest_framework.parsers import MultiPartParser, FormParser
+from rest_framework.parsers import MultiPartParser, FormParser, JSONParser
 from rest_framework.filters import SearchFilter
+
+from .permissions import IsAuthenticatedOrReadOnly
 from .models import Plant
 from .serializers import PlantSerializer
 
@@ -10,12 +12,14 @@ from .serializers import PlantSerializer
 class PlantListCreateAPIView(generics.ListCreateAPIView):
     queryset = Plant.objects.all()
     serializer_class = PlantSerializer
-    parser_classes = [MultiPartParser, FormParser]  # Allow file uploads
+    parser_classes = [JSONParser, MultiPartParser, FormParser]  # Allow file uploads
     filter_backends = [SearchFilter]  # Add search filter
     search_fields = ['name', 'description']  # Search by name and description
-
+    permission_classes = [IsAuthenticatedOrReadOnly]  # Apply custom permission
+    
 # Retrieve, Update, and Delete a Plant
 class PlantRetrieveUpdateDestroyAPIView(generics.RetrieveUpdateDestroyAPIView):
     queryset = Plant.objects.all()
     serializer_class = PlantSerializer
-    parser_classes = [MultiPartParser, FormParser]  # Allow file uploads and form data
+    parser_classes = [JSONParser, MultiPartParser, FormParser]  # Allow file uploads and form data
+    permission_classes = [IsAuthenticatedOrReadOnly]  # Apply custom permission

plant_catalog/catalog/permissions.py

@@ -0,0 +1,10 @@
+from rest_framework.permissions import SAFE_METHODS, BasePermission
+
+class IsAuthenticatedOrReadOnly(BasePermission):
+    """
+    Allows GET, HEAD, OPTIONS for everyone, but restricts POST, PUT, DELETE to authenticated users.
+    """
+    def has_permission(self, request, view):
+        if request.method in SAFE_METHODS:
+            return True  # Allow read-only access
+        return request.user and request.user.is_authenticated

plant_catalog/catalog/urls.py

@@ -2,10 +2,16 @@
 
 from django.http import HttpResponseRedirect
 from django.urls import path
+from rest_framework_simplejwt.views import TokenObtainPairView, TokenRefreshView
 from .api_views import PlantListCreateAPIView, PlantRetrieveUpdateDestroyAPIView
 
 urlpatterns = [
     path('', lambda request: HttpResponseRedirect('/api/plants/')),
     path('api/plants/', PlantListCreateAPIView.as_view(), name='plant_list_create'),  # List and Create
     path('api/plants/<int:pk>/', PlantRetrieveUpdateDestroyAPIView.as_view(), name='plant_detail_update_delete'),  # Retrieve, Update, Delete
-]
+    path('api/token/', TokenObtainPairView.as_view(), name='token_obtain_pair'),
+    path('api/token/refresh/', TokenRefreshView.as_view(), name='token_refresh'),
+]
+
+
+

plant_catalog/plant_catalog/settings.py

@@ -12,7 +12,6 @@ https://docs.djangoproject.com/en/5.0/ref/settings/
 
 import os
 from pathlib import Path
-import logging
 
 # Build paths inside the project like this: BASE_DIR / 'subdir'.
 BASE_DIR = Path(__file__).resolve().parent.parent
@@ -33,6 +32,18 @@ ALLOWED_HOSTS = ['gonzalohd.eu', 'plantsapi.gonzalohd.eu', 'localhost', '192.168
 
 CSRF_TRUSTED_ORIGINS = [
     "https://succulentspectrum.gonzalohd.eu",
+    "https://plantsapi.gonzalohd.eu",
+    "http://localhost:5173",  # local development URL
+]
+
+CORS_ALLOW_HEADERS = [
+    'authorization',
+    'content-type',
+    'accept',
+    'origin',
+    'x-requested-with',
+    'user-agent',
+    'accept-language',
 ]
 
 
@@ -63,6 +74,11 @@ MIDDLEWARE = [
     'django.middleware.clickjacking.XFrameOptionsMiddleware',
 ]
 
+
+SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
+USE_X_FORWARDED_HOST = True
+
+
 CORS_ALLOW_ALL_ORIGINS = True  # Allow all origins for development
 
 ROOT_URLCONF = 'plant_catalog.urls'
@@ -91,6 +107,14 @@ REST_FRAMEWORK = {
     ),
     'DEFAULT_PARSER_CLASSES': (
         'rest_framework.parsers.JSONParser',
+        'rest_framework.parsers.FormParser',
+        'rest_framework.parsers.MultiPartParser',
+    ),
+        'DEFAULT_AUTHENTICATION_CLASSES': (
+        'rest_framework_simplejwt.authentication.JWTAuthentication',
+    ),
+    'DEFAULT_PERMISSION_CLASSES': (
+        'rest_framework.permissions.IsAuthenticated',
     ),
 }
 
@@ -191,4 +215,4 @@ LOGGING = {
 
 
 
-USE_X_FORWARDED_HOST = True
+

requirements.txt

@@ -2,6 +2,12 @@ asgiref==3.8.1
 Django==5.0.8
 django-cors-headers==4.4.0
 djangorestframework==3.15.2
+djangorestframework-simplejwt==5.3.1
 mysqlclient==2.2.4
 pillow==10.4.0
 sqlparse==0.5.1
+
+pip==23.0.1
+PyJWT==2.10.0
+setuptools==66.1.1
+wheel==0.37.0