fix: review issues - enforce IsAuthenticated for API, secure CORS via env vars

api/jobs/views.py

@@ -1,5 +1,6 @@
 from django.db.models import Count, Q
-from rest_framework import permissions, viewsets
+from rest_framework import viewsets
+from rest_framework.permissions import IsAuthenticated
 from rest_framework.decorators import action
 from rest_framework.request import Request
 from rest_framework.response import Response
@@ -15,13 +16,13 @@ from .serializers import (
 class JobApplicationViewSet(viewsets.ModelViewSet):
     queryset = JobApplication.objects.all().prefetch_related("updates")
     serializer_class = JobApplicationSerializer
-    permission_classes = [permissions.AllowAny]
+    permission_classes = [IsAuthenticated]
 
 
 class JobUpdateViewSet(viewsets.ModelViewSet):
     queryset = JobUpdate.objects.select_related("job_application").all()
     serializer_class = JobUpdateSerializer
-    permission_classes = [permissions.AllowAny]
+    permission_classes = [IsAuthenticated]
 
     @action(detail=False, methods=["get"])
     def latest(self, request: Request) -> Response:

api/project/settings.py

@@ -90,12 +90,20 @@ USE_TZ = True
 DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
 
 # CORS
-CORS_ALLOW_ALL_ORIGINS = True
+CORS_ALLOW_ALL_ORIGINS = os.environ.get("CORS_ALLOW_ALL_ORIGINS", "False").lower() in ("true", "1", "yes")
+CORS_ALLOWED_ORIGINS = os.environ.get(
+    "CORS_ALLOWED_ORIGINS",
+    "http://localhost:3000,http://localhost:5173,http://127.0.0.1:3000",
+).split(",")
 
 # REST Framework
 REST_FRAMEWORK = {
     "DEFAULT_PERMISSION_CLASSES": [
-        "rest_framework.permissions.AllowAny",
+        "rest_framework.permissions.IsAuthenticated",
+    ],
+    "DEFAULT_AUTHENTICATION_CLASSES": [
+        "rest_framework_simplejwt.authentication.JWTAuthentication",
+        "rest_framework.authentication.SessionAuthentication",
     ],
 }