From 22d36cb7df25e31b14ac17eb059fc6ef62b21f4c Mon Sep 17 00:00:00 2001 From: "Marko (Hermes Implementer)" Date: Tue, 26 May 2026 06:06:16 +0000 Subject: [PATCH] fix: review issues - enforce IsAuthenticated for API, secure CORS via env vars --- api/jobs/views.py | 7 ++++--- api/project/settings.py | 12 ++++++++++-- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/api/jobs/views.py b/api/jobs/views.py index b76000d..a1f91c0 100644 --- a/api/jobs/views.py +++ b/api/jobs/views.py @@ -1,5 +1,6 @@ from django.db.models import Count, Q -from rest_framework import permissions, viewsets +from rest_framework import viewsets +from rest_framework.permissions import IsAuthenticated from rest_framework.decorators import action from rest_framework.request import Request from rest_framework.response import Response @@ -15,13 +16,13 @@ from .serializers import ( class JobApplicationViewSet(viewsets.ModelViewSet): queryset = JobApplication.objects.all().prefetch_related("updates") serializer_class = JobApplicationSerializer - permission_classes = [permissions.AllowAny] + permission_classes = [IsAuthenticated] class JobUpdateViewSet(viewsets.ModelViewSet): queryset = JobUpdate.objects.select_related("job_application").all() serializer_class = JobUpdateSerializer - permission_classes = [permissions.AllowAny] + permission_classes = [IsAuthenticated] @action(detail=False, methods=["get"]) def latest(self, request: Request) -> Response: diff --git a/api/project/settings.py b/api/project/settings.py index 5a81516..e134f88 100644 --- a/api/project/settings.py +++ b/api/project/settings.py @@ -90,12 +90,20 @@ USE_TZ = True DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField" # CORS -CORS_ALLOW_ALL_ORIGINS = True +CORS_ALLOW_ALL_ORIGINS = os.environ.get("CORS_ALLOW_ALL_ORIGINS", "False").lower() in ("true", "1", "yes") +CORS_ALLOWED_ORIGINS = os.environ.get( + "CORS_ALLOWED_ORIGINS", + "http://localhost:3000,http://localhost:5173,http://127.0.0.1:3000", +).split(",") # REST Framework REST_FRAMEWORK = { "DEFAULT_PERMISSION_CLASSES": [ - "rest_framework.permissions.AllowAny", + "rest_framework.permissions.IsAuthenticated", + ], + "DEFAULT_AUTHENTICATION_CLASSES": [ + "rest_framework_simplejwt.authentication.JWTAuthentication", + "rest_framework.authentication.SessionAuthentication", ], }