added key authentication and some api tests

api/resources.py

@@ -8,6 +8,7 @@ from tastypie import fields
 from tastypie.constants import ALL, ALL_WITH_RELATIONS
 from tastypie.resources import ModelResource, Resource, Bundle
 from tastypie.utils import trailing_slash
+from tastypie.authentication import ApiKeyAuthentication
 
 from regluit.core import models
 
@@ -17,12 +18,14 @@ logger = logging.getLogger(__name__)
 
 class UserResource(ModelResource):
     class Meta:
+        authentication = ApiKeyAuthentication()
         queryset = User.objects.all()
         resource_name = 'user'
         fields = ['username', 'first_name', 'last_name']
 
 class EditionResource(ModelResource):
     class Meta:
+        authentication = ApiKeyAuthentication()
         queryset = models.Edition.objects.all()
         resource_name = 'edition'
         filtering = {
@@ -32,6 +35,7 @@ class EditionResource(ModelResource):
 class WorkResource(ModelResource):
     editions = fields.ToManyField(EditionResource, 'editions')
     class Meta:
+        authentication = ApiKeyAuthentication()
         queryset = models.Work.objects.all()
         resource_name = 'work'
         filtering = {'editions': ALL_WITH_RELATIONS, 'id': ALL}
@@ -39,6 +43,7 @@ class WorkResource(ModelResource):
 class CampaignResource(ModelResource):
     work = fields.ToOneField(WorkResource, 'work')
     class Meta:
+        authentication = ApiKeyAuthentication()
         queryset = models.Campaign.objects.all()
         resource_name = 'campaign'
         excludes = ['amazon_receiver', 'paypal_receiver']
@@ -49,18 +54,21 @@ class CampaignResource(ModelResource):
 class AuthorResource(ModelResource):
     works = fields.ToManyField(WorkResource, 'works')
     class Meta:
+        authentication = ApiKeyAuthentication()
         queryset = models.Author.objects.all()
         resource_name = 'author'
 
 class SubjectResource(ModelResource):
     works = fields.ToManyField(WorkResource, 'works')
     class Meta:
+        authentication = ApiKeyAuthentication()
         queryset = models.Subject.objects.all()
         resource_name = 'subject'
 
 class EditionCoverResource(ModelResource):
     edition = fields.ToManyField(EditionResource, 'editions')
     class Meta:
+        authentication = ApiKeyAuthentication()
         queryset = models.EditionCover.objects.all()
         resource_name = 'editioncover'
 
@@ -68,5 +76,6 @@ class WishlistResource(ModelResource):
     user = fields.ToOneField(UserResource, 'user')
     works = fields.ToManyField(WorkResource, 'works')
     class Meta:
+        authentication = ApiKeyAuthentication()
         queryset = models.Wishlist.objects.all()
         resource_name = 'wishlist'

api/tests.py

@@ -3,10 +3,11 @@ import datetime
 
 from django.test import TestCase
 from django.test.client import Client
+from django.contrib.auth.models import User
 
 from regluit.core import bookloader, models
 
-class CampaignTests(TestCase):
+class ApiTests(TestCase):
 
     def setUp(self):
         edition = bookloader.add_book(isbn='0441012035')
@@ -17,10 +18,23 @@ class CampaignTests(TestCase):
             deadline=datetime.datetime.now(),
             target=1000.0,
         )
+        self.user = User.objects.create_user('test', 'test@example.com', 'testpass')
         self.client = Client()
 
-    def test_campaigns(self):
+    def test_user(self):
+        self.assertEqual(User.objects.all().count(), 1)
+        self.assertTrue(User.objects.all()[0].api_key.key)
+
+    def test_no_auth(self):
         r = self.client.get('/api/v1/campaign/', data={'format': 'json'})
+        self.assertEqual(r.status_code, 401)
+
+    def test_campaigns(self):
+        r = self.client.get('/api/v1/campaign/', data={
+            'format': 'json', 
+            'username': self.user.username, 
+            'api_key': self.user.api_key.key
+        })
         self.assertEqual(r.status_code, 200)
         j = json.loads(r.content)
         self.assertEqual(len(j['objects']), 1)
@@ -28,15 +42,23 @@ class CampaignTests(TestCase):
         self.assertEqual(j['objects'][0]['work'], '/api/v1/work/1/')
 
     def test_campaign(self):
-        r = self.client.get('/api/v1/campaign/1/', data={'format': 'json'})
+        r = self.client.get('/api/v1/campaign/1/', data={
+            'format': 'json', 
+            'username': self.user.username, 
+            'api_key': self.user.api_key.key
+        })
         self.assertEqual(r.status_code, 200)
         j = json.loads(r.content)
         self.assertEqual(j['name'], 'Neuromancer')
         self.assertEqual(j['work'], '/api/v1/work/1/')
 
     def test_campaign_lookup_by_isbn(self):
-        url = '/api/v1/campaign/?work__editions__isbn_10=0441012035'
-        r = self.client.get('/api/v1/campaign/', data={'format': 'json', 'work__editions__isbn_10': '0441012035'})
+        r = self.client.get('/api/v1/campaign/', data={
+            'format': 'json', 
+            'work__editions__isbn_10': '0441012035', 
+            'username': self.user.username, 
+            'api_key': self.user.api_key.key
+        })
         self.assertEqual(r.status_code, 200)
         j = json.loads(r.content)
         self.assertEqual(len(j['objects']), 1)

core/signals.py

@@ -5,6 +5,7 @@ from django.contrib.auth.models import User
 
 from social_auth.signals import pre_update
 from social_auth.backends.facebook import FacebookBackend
+from tastypie.models import create_api_key
 
 
 def facebook_extra_values(sender, user, response, details, **kwargs):
@@ -17,14 +18,15 @@ pre_update.connect(facebook_extra_values, sender=FacebookBackend)
 
 def create_wishlist(sender, created, instance, **kwargs):
     # use get_model to avoid circular import problem with models
-    # this fails when a superuser is being created as part of a syncdb
-    # since the database table for wishlist doesn't exist yet
     try:
         Wishlist = get_model('core', 'Wishlist')
         if created:
             Wishlist.objects.create(user=instance)
+
     except DatabaseError:
+        # this can happen when creating superuser during syncdb since the
+        # core_wishlist table doesn't exist yet
         return
 
-
 post_save.connect(create_wishlist, sender=User)
+post_save.connect(create_api_key, sender=User)