Feature/token auth

src/objecttypes/conf/api.py

@@ -8,6 +8,10 @@
     "DEFAULT_RENDERER_CLASSES": ["rest_framework.renderers.JSONRenderer"],
     "DEFAULT_PARSER_CLASSES": ["rest_framework.parsers.JSONParser"],
     "DEFAULT_FILTER_BACKENDS": ["vng_api_common.filters.Backend"],
+    "DEFAULT_AUTHENTICATION_CLASSES": [
+        "rest_framework.authentication.TokenAuthentication"
+    ],
+    "DEFAULT_PERMISSION_CLASSES": ["rest_framework.permissions.IsAuthenticated"],
     # test
     "TEST_REQUEST_DEFAULT_FORMAT": "json",
 }
@@ -17,6 +21,9 @@
 SWAGGER_SETTINGS.update(
     {
         "DEFAULT_INFO": "objecttypes.api.schema.info",
-        "SECURITY_DEFINITIONS": None,
+        # Use apiKey type since OAS2 doesn't support Bearer authentication
+        "SECURITY_DEFINITIONS": {
+            "Token": {"type": "apiKey", "name": "Authorization", "in": "header"}
+        },
     }
 )

src/objecttypes/conf/base.py

@@ -69,6 +69,7 @@
     "compat",  # Part of hijack
     "hijack_admin",
     "rest_framework",
+    "rest_framework.authtoken",
     "drf_yasg",
     "vng_api_common",
     # Project applications.

src/objecttypes/tests/test_auth.py

@@ -0,0 +1,21 @@
+from django.urls import reverse
+
+from rest_framework import status
+from rest_framework.test import APITestCase
+
+from objecttypes.core.tests.factories import ObjectTypeFactory
+
+
+class AuthTests(APITestCase):
+    def test_non_auth(self):
+        object_type = ObjectTypeFactory.create()
+
+        urls = [
+            reverse("objecttype-list"),
+            reverse("objecttype-detail", args=[object_type.uuid]),
+        ]
+
+        for url in urls:
+            with self.subTest(url=url):
+                response = self.client.get(url)
+                self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)

src/objecttypes/tests/test_filters.py

@@ -4,9 +4,10 @@
 from rest_framework.test import APITestCase
 
 from objecttypes.core.tests.factories import ObjectTypeFactory
+from objecttypes.utils.test import TokenAuthMixin
 
 
-class FilterTests(APITestCase):
+class FilterTests(TokenAuthMixin, APITestCase):
     url = reverse_lazy("objecttype-list")
 
     def test_filter_public_data(self):

src/objecttypes/tests/test_objecttype_api.py

@@ -4,9 +4,10 @@
 from rest_framework.test import APITestCase
 
 from objecttypes.core.tests.factories import ObjectTypeFactory, ObjectVersionFactory
+from objecttypes.utils.test import TokenAuthMixin
 
 
-class ObjectTypeAPITests(APITestCase):
+class ObjectTypeAPITests(TokenAuthMixin, APITestCase):
     def test_get_objecttypes(self):
         object_type = ObjectTypeFactory.create()
         object_version = ObjectVersionFactory.create(object_type=object_type)

src/objecttypes/utils/test.py

@@ -0,0 +1,17 @@
+from rest_framework.authtoken.models import Token
+
+from objecttypes.accounts.models import User
+
+
+class TokenAuthMixin:
+    @classmethod
+    def setUpTestData(cls):
+        super().setUpTestData()
+
+        test_user = User.objects.create(username="testsuite", password="letmein")
+        cls.token = Token.objects.create(user=test_user)
+
+    def setUp(self):
+        super().setUp()
+
+        self.client.credentials(HTTP_AUTHORIZATION=f"Token {self.token}")

src/openapi.yaml

@@ -3,6 +3,8 @@ info:
   title: objecttypes API
   description: An API to access Object types
   version: 0.1.0
+security:
+- Token: []
 paths:
   /objecttypes/:
     get:
@@ -308,6 +310,11 @@ tags:
 servers:
 - url: https://example.com/api/v1
 components:
+  securitySchemes:
+    Token:
+      type: apiKey
+      name: Authorization
+      in: header
   schemas:
     ObjectVersion:
       type: object

src/swagger2.0.json

@@ -16,6 +16,18 @@
     "produces": [
         "application/json"
     ],
+    "securityDefinitions": {
+        "Token": {
+            "type": "apiKey",
+            "name": "Authorization",
+            "in": "header"
+        }
+    },
+    "security": [
+        {
+            "Token": []
+        }
+    ],
     "paths": {
         "/objecttypes/": {
             "get": {