Implemented separate login and register pages with:
**Backend:**
- Custom User model using email as USERNAME_FIELD
- POST /api/auth/register/ with email validation, password min 8 chars, confirm match, duplicate check
- POST /api/auth/login/ with JWT token generation
- Django PBKDF2 password hashing
- No user enumeration on login
**Frontend:**
- LoginPage with email/password form, error states, loading spinner
- RegisterPage with name/email/password/confirm form + client-side validation
- AuthContext with useReducer pattern, localStorage token management
- Route state passes success message from registration to login
- VITE_API_URL env var (fixed Vite prefix in docker-compose)
**Fixes vs prior attempt:**
- AuthContext.register no longer sets AUTH_SUCCESS (user must log in after registering)
- LoginPage displays successMessage from route state (from RegisterPage redirect)
- docker-compose REACT_APP_API_URL -> VITE_API_URL
- Django settings: added admin, messages, staticfiles apps
- Spec document: docs/auth-implementation.md
- web/.env.example for API URL config
Issue: crisleo-hermes/job-tracker#3
- Custom User model with email as unique identifier (AUTH_USER_MODEL)
- POST /api/auth/register/ with email validation, password min 8 chars, duplicate rejection
- POST /api/auth/login/ returning JWT (access + refresh) tokens
- Passwords hashed via Django's make_password
- React LoginPage and RegisterPage with form validation
- AuthContext with useReducer for auth state management
- Axios API client with JWT token injection
- TypeScript conversion of frontend scaffold
These MUST be resolved before this PR can be merged.
[File: api/project/settings.py | Line ~82]configuration error AUTH_USER_MODEL=*** is still a placeholder value. Django will fail at runtime when trying to resolve the custom user model. Must be changed to AUTH_USER_MODEL="accounts.User".
🟡 Suggestions (Non-Blocking)
These are recommendations for improvement. Not required for merge.
[File: api/accounts/admin.py] Consider adding list_filter for is_staff, is_active fields to improve admin usability.
[File: web/src/services/authApi.ts] Consider adding a response interceptor to handle 401 redirects globally.
## Reid's Review — PR #12
**Verdict:** 🔴 Changes Required (Update)
---
### 🔴 Blocking Issues
> These MUST be resolved before this PR can be merged.
- **[File: api/project/settings.py | Line ~82]** `configuration error`
`AUTH_USER_MODEL=***` is still a placeholder value. Django will fail at runtime when trying to resolve the custom user model. Must be changed to `AUTH_USER_MODEL="accounts.User"`.
---
### 🟡 Suggestions (Non-Blocking)
> These are recommendations for improvement. Not required for merge.
- **[File: api/accounts/admin.py]** Consider adding `list_filter` for `is_staff`, `is_active` fields to improve admin usability.
- **[File: web/src/services/authApi.ts]** Consider adding a response interceptor to handle 401 redirects globally.
---
### 📋 AC Coverage
Based on linked issue #3
- [x] POST /api/auth/register/ endpoint
- [x] POST /api/auth/login/ endpoint
- [x] Email validation with regex
- [x] Password minimum 8 characters enforced
- [x] Password confirmation match
- [x] Duplicate email rejection
- [x] Django PBKDF2 password hashing
- [x] JWT tokens on successful login
- [x] Separate LoginPage and RegisterPage
- [x] Redirects to dashboard after login
- [x] CSS modules used for styling (correct approach)
- [x] Rate limiting on auth endpoints
- [x] Permission classes on endpoints
The merge commit 48db53c (Merge branch main into feature/user-auth) already resolved this: AUTH_USER_MODEL is now set to "accounts.User" (inherited from main).
This specific blocker should be cleared — ready for re-review.
✅ **AUTH_USER_MODEL blocker resolved.**
The merge commit `48db53c` (Merge branch `main` into `feature/user-auth`) already resolved this: `AUTH_USER_MODEL` is now set to `"accounts.User"` (inherited from main).
This specific blocker should be cleared — ready for re-review.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Implemented separate login and register pages with:
Backend:
Frontend:
Fixes vs prior attempt:
Issue: crisleo-hermes/job-tracker#3
Reid's Review — PR #12
Verdict: 🔴 Changes Required (Update)
🔴 Blocking Issues
configuration errorAUTH_USER_MODEL=***is still a placeholder value. Django will fail at runtime when trying to resolve the custom user model. Must be changed toAUTH_USER_MODEL="accounts.User".🟡 Suggestions (Non-Blocking)
list_filterforis_staff,is_activefields to improve admin usability.📋 AC Coverage
Based on linked issue #3
✅ AUTH_USER_MODEL blocker resolved.
The merge commit
48db53c(Merge branchmainintofeature/user-auth) already resolved this:AUTH_USER_MODELis now set to"accounts.User"(inherited from main).This specific blocker should be cleared — ready for re-review.