diff --git a/InvenTree/InvenTree/api_version.py b/InvenTree/InvenTree/api_version.py index 14c180388c..d272ac54e6 100644 --- a/InvenTree/InvenTree/api_version.py +++ b/InvenTree/InvenTree/api_version.py @@ -2,11 +2,15 @@ # InvenTree API version -INVENTREE_API_VERSION = 139 +INVENTREE_API_VERSION = 140 """ Increment this API version number whenever there is a significant change to the API that any clients need to know about +v140 -> 2023-10-20 : https://github.com/inventree/InvenTree/pull/5664 + - Expand API token functionality + - Multiple API tokens can be generated per user + v139 -> 2023-10-11 : https://github.com/inventree/InvenTree/pull/5509 - Add new BarcodePOReceive endpoint to receive line items by scanning supplier barcodes diff --git a/InvenTree/InvenTree/middleware.py b/InvenTree/InvenTree/middleware.py index 6a365d82de..c34c5416e8 100644 --- a/InvenTree/InvenTree/middleware.py +++ b/InvenTree/InvenTree/middleware.py @@ -12,9 +12,9 @@ from django.urls import Resolver404, include, re_path, resolve, reverse_lazy from allauth_2fa.middleware import (AllauthTwoFactorMiddleware, BaseRequire2FAMiddleware) from error_report.middleware import ExceptionProcessor -from rest_framework.authtoken.models import Token from InvenTree.urls import frontendpatterns +from users.models import ApiToken logger = logging.getLogger("inventree") @@ -75,13 +75,15 @@ class AuthRequiredMiddleware(object): # Does the provided token match a valid user? try: - token = Token.objects.get(key=token_key) + token = ApiToken.objects.get(key=token_key) - # Provide the user information to the request - request.user = token.user - authorized = True + if token.active and token.user: - except Token.DoesNotExist: + # Provide the user information to the request + request.user = token.user + authorized = True + + except ApiToken.DoesNotExist: logger.warning("Access denied for unknown token %s", token_key) # No authorization was found for the request diff --git a/InvenTree/InvenTree/settings.py b/InvenTree/InvenTree/settings.py index 32f6ebfc35..206b4a697b 100644 --- a/InvenTree/InvenTree/settings.py +++ b/InvenTree/InvenTree/settings.py @@ -197,7 +197,18 @@ if DBBACKUP_STORAGE_OPTIONS is None: 'location': config.get_backup_dir(), } -# Application definition +INVENTREE_ADMIN_ENABLED = get_boolean_setting( + 'INVENTREE_ADMIN_ENABLED', + config_key='admin_enabled', + default_value=True +) + +# Base URL for admin pages (default="admin") +INVENTREE_ADMIN_URL = get_setting( + 'INVENTREE_ADMIN_URL', + config_key='admin_url', + default_value='admin' +) INSTALLED_APPS = [ # Admin site integration @@ -232,7 +243,6 @@ INSTALLED_APPS = [ # Third part add-ons 'django_filters', # Extended filter functionality 'rest_framework', # DRF (Django Rest Framework) - 'rest_framework.authtoken', # Token authentication for API 'corsheaders', # Cross-origin Resource Sharing for DRF 'crispy_forms', # Improved form rendering 'import_export', # Import / export tables to file @@ -379,14 +389,6 @@ if DEBUG: INSTALLED_APPS.append('sslserver') # InvenTree URL configuration - -# Base URL for admin pages (default="admin") -INVENTREE_ADMIN_URL = get_setting( - 'INVENTREE_ADMIN_URL', - config_key='admin_url', - default_value='admin' -) - ROOT_URLCONF = 'InvenTree.urls' TEMPLATES = [ @@ -433,7 +435,7 @@ REST_FRAMEWORK = { 'DEFAULT_AUTHENTICATION_CLASSES': ( 'rest_framework.authentication.BasicAuthentication', 'rest_framework.authentication.SessionAuthentication', - 'rest_framework.authentication.TokenAuthentication', + 'users.authentication.ApiTokenAuthentication', ), 'DEFAULT_PAGINATION_CLASS': 'rest_framework.pagination.LimitOffsetPagination', 'DEFAULT_PERMISSION_CLASSES': ( @@ -445,7 +447,8 @@ REST_FRAMEWORK = { 'DEFAULT_METADATA_CLASS': 'InvenTree.metadata.InvenTreeMetadata', 'DEFAULT_RENDERER_CLASSES': [ 'rest_framework.renderers.JSONRenderer', - ] + ], + 'TOKEN_MODEL': 'users.models.ApiToken', } if DEBUG: diff --git a/InvenTree/InvenTree/urls.py b/InvenTree/InvenTree/urls.py index 742848c328..b55bf78fbb 100644 --- a/InvenTree/InvenTree/urls.py +++ b/InvenTree/InvenTree/urls.py @@ -209,11 +209,14 @@ classic_frontendpatterns = [ new_frontendpatterns = platform_urls -urlpatterns = [ - # admin sites - re_path(f'^{settings.INVENTREE_ADMIN_URL}/error_log/', include('error_report.urls')), - re_path(f'^{settings.INVENTREE_ADMIN_URL}/', admin.site.urls, name='inventree-admin'), -] +urlpatterns = [] + +if settings.INVENTREE_ADMIN_ENABLED: + admin_url = settings.INVENTREE_ADMIN_URL, + urlpatterns += [ + path(f'{admin_url}/error_log/', include('error_report.urls')), + path(f'{admin_url}/', admin.site.urls, name='inventree-admin'), + ] urlpatterns += backendpatterns diff --git a/InvenTree/build/templates/build/build_base.html b/InvenTree/build/templates/build/build_base.html index 2f1ea421b6..3eb50e1270 100644 --- a/InvenTree/build/templates/build/build_base.html +++ b/InvenTree/build/templates/build/build_base.html @@ -29,10 +29,9 @@ src="{% static 'img/blank_image.png' %}" {% block actions %} -{% if user.is_staff and roles.build.change %} -{% url 'admin:build_build_change' build.pk as url %} +{% admin_url user "build.build" build.pk as url %} {% include "admin_button.html" with url=url %} -{% endif %} + {% if barcodes %}
diff --git a/InvenTree/company/templates/company/company_base.html b/InvenTree/company/templates/company/company_base.html index 7953635671..238c53847e 100644 --- a/InvenTree/company/templates/company/company_base.html +++ b/InvenTree/company/templates/company/company_base.html @@ -14,10 +14,9 @@ {% block actions %} -{% if user.is_staff and perms.company.change_company %} -{% url 'admin:company_company_change' company.pk as url %} +{% admin_url user "company.company" company.pk as url %} {% include "admin_button.html" with url=url %} -{% endif %} + {% if company.is_supplier and roles.purchase_order.add %} diff --git a/InvenTree/templates/admin_button.html b/InvenTree/templates/admin_button.html index abc3d2d91c..9f0e8acfbc 100644 --- a/InvenTree/templates/admin_button.html +++ b/InvenTree/templates/admin_button.html @@ -3,7 +3,7 @@ {% inventree_customize 'hide_admin_link' as hidden %} -{% if not hidden and user.is_staff %} +{% if url and not hidden and user.is_staff %}